Skynet Source LAN IP for outbound IP blocked by SkyNet

[buzzy]

How do I find the local source LAN IPs for outbound IP addresses that are blocked by Diversion Skynet? Basically, whodunnit? I have SkyNet and local Pi-Hole running, but not Diversion. In looking at the top 10 Blocks (Outbound) list in SkyNet, I see the IP addresses and the AlienVault information, but I want to trace it back to my LAN to see which device is trying to reach out to these blocked IPs? It doesn't seem to appear in Pi-Hole but maybe I am not sure how to query it because it only shows domain (non-IP) entries.

Bonus question: if I can figure it out that it's a specific Windows device, is there any particular log in Windows that helps me determine which application is trying to reach these blocked IPs?

 

[dave14305]

How are Diversion and Pi-Hole both blocking? I’m confused. Where do you actually see the blocks?

 

[ColinTaylor]

You want to know the source IP addresses being blocked by Diversion but you're not running Diversion.

 

[buzzy]

You want to know the source IP addresses being blocked by Diversion but you're not running Diversion.

Doh! ... I had a Brain Fart. I meant SkyNet, not Diversion. I just went back to edit my original post.

 

[buzzy]

How are Diversion and Pi-Hole both blocking? I’m confused. Where do you actually see the blocks?

Sorry, I meant Skynet. I am not using Diversion. Pi-Hole is just doing it's usual duties as DNS Server to block ads etc., even though it's somewhat of an overlap with SkyNet. DNS does keep great logs of logs, but only the domain names, but not the actual IP addresses, as far as I know.

 

[dave14305]

If Skynet is blocking, you can see stats by running

firewall stats search ip 12.34.56.78

where the IP would be the destination IP you see being blocked.

 

[buzzy]

If Skynet is blocking, you can see stats by running

firewall stats search ip 12.34.56.78

where the IP would be the destination IP you see being blocked.

Awesome! This is exactly what I was looking for, thanks!

As a minor note, the section titles (in red) state "10 Most Recent Blocks From x.x.x.x", etc, rather than something like " ... Outgoing Blocks To x.x.x.x". Again, very minor.

 

[martinr]

Awesome! This is exactly what I was looking for, thanks!

As a minor note, the section titles (in red) state "10 Most Recent Blocks From x.x.x.x", etc, rather than something like " ... Outgoing Blocks To x.x.x.x". Again, very minor.

And you can find more magical commands, like the one dave14305 listed, here:


https://www.snbforums.com/threads/skynet-router-firewall-security-enhancements.16798/post-115872

 

[buzzy]

And you can find more magical commands, like the one dave14305 listed, here:


https://www.snbforums.com/threads/skynet-router-firewall-security-enhancements.16798/post-115872

Thanks!