Network threat blocked

This notification appears when ESET detects suspicious network activity, such as port scanning attempts, exploit attempts, or traffic patterns associated with malicious software. In some cases, the activity originates from an application running on your device. You can use logs and network monitoring tools to identify the source of the traffic.

How to identify the application generating the traffic

You can find the type of threat and the related device IP address in the notification. Click Change handling of this threat to show the following options:

Continue blocking—Blocks detected threat. If you want to stop receiving notifications about this type of threat from the specific remote address, select the radio button next to Do not notify before you click Continue blocking. This will create an Intrusion Detection Service (IDS) rule with the following configuration:

Allow—Creates an Intrusion Detection Service (IDS) rule to allow the detected threat. Select one from the following options before you click Allow to specify the rule settings:

A Network threat blocked event does not always indicate a real attack. Common causes include:

•Legitimate devices on the local network, such as home routers, mesh nodes, Wi-Fi extenders, NAS devices, smart TVs and multimedia devices.

•Applications running on your device may open or probe multiple ports or communicate with other devices on the network (for example, file-sharing, streaming, remote administration utilities or update services)

•Malicious activity, such as port scanning attacks, communication from an infected device on the same network, or unwanted or suspicious processes running on your device.