AiProtection - Two-way IPS ?

[Netbug]

Hi,

On the tab AiProtection -> Two-way IPS

Under top client it show's a MAC address with 15 hits. Is the MAC address suppose to be something on my network, ie a potential malicious device/app on a device or something similar connecting out or is it the MAC address where the attack came from? i can't find that mac address anywhere on my network, it's not my devices. Just a bit confused.

Also according it Two-Way IPS i've had a total of 18 high severity hits. Majority coming from same IP. Checking Alient Vault it says malicious host, actively malicious.

Security threats were:
EXPLOT Netcore Router Back Door Access
EXPLOT Remote Command Execution via Shell SCript -2

Checking the first part of mac address online just says Juniper Networks.

Cheers.

 

[ColinTaylor]

It can't be the originating source of the attack because MAC addresses don't travel outside the local network. It's probably your ISP's equipment connected downstream of your WAN interface.

 

[Netbug]

It can't be the originating source of the attack because MAC addresses don't travel outside the local network. It's probably your ISP's equipment connected downstream of your WAN interface.

doh have dumb am i, it's not the MAC of my modem, router or devices so must be although i don't why it shows MAC address if it going to be the same one. slightly confusing i think, i dont see no point or get why it's there, maybe it logs MAC address for suspected malicious devices on local network.

Surprised when i saw 15 high severity attacks. Gives an insight to be fair into what people/bots are up to.

Thank you.

 

[OzarkEdge]

doh have dumb am i, it's not the MAC of my modem, router or devices so must be although i don't why it shows MAC address if it going to be the same one. slightly confusing i think, i dont see no point or get why it's there, maybe it logs MAC address for suspected malicious devices on local network.

Surprised when i saw 15 high severity attacks. Gives an insight to be fair into what people/bots are up to.

Thank you.

The keyword listed that you have to trust is source "external". Listing a [foreign] MAC makes it appear to be internal and hence, overly alarming, imo. ASUS, if the external MAC is useless information, why bother the user with it... just call it 'external' and leave it at that.

OE