Client behaviour - Application usage details explanation

GiuseppeR

Hello everyone,

I have a client inside a network that seems to have something related to Avast:

In reality it is a domain client, without the possibility to install anything.

So I remotely connected to it looking for Avast traces but I did not see something reasonable considering the quick analysis.

Which sort of way of classification does Nebula use to identify "Application usage"?

How can I see if those 337MB are related to web traffic or server traffic? Like where is the origin of this traffic?

Zyxel_Tina

Hi @GiuseppeR,

Regarding your question, taking Facebook as an example, users do not necessarily need to have the Facebook app installed, but can still browse Facebook via a web browser. In the same way, even if Avast is not installed on the PC, traffic can still be classified as Avast if the client accesses Avast-related domains (website).

To confirm the traffic originating from, please follow the steps:

1. Create an application profile for Avast.
2. Add a security policy that allows/references this application profile.
3. Then check the event log — if this rule is hit, you will see the destination IP and port information. This will help verify whether the traffic is indeed originating from Avast servers.

If you still have concerns about the Application Usage results after this check, we would kindly ask you to enable the Zyxel Support Access and provide the Org & site name via private message so that we can further observe and analyze the behavior.

GiuseppeR

Hi @Zyxel_Tina

do you mean something like this screenshot?

With these details:

inside the profile?

Zyxel_Tina

Hi @GiuseppeR,

Sorry for the late reply!

Regarding your question, the settings look correct. Please note that after applying them, you may need to observe for a while until the policy is hit again. If you encounter any further issues, please feel free to provide us with more information so we can assist you better.

GiuseppeR

Hi @Zyxel_Tina

sent you some examples of those logs, to share details.

Zyxel_Tina

Hi @GiuseppeR,

According to the log you provided, we now know the specific clients and timestamps to have Avast-related traffic, we suggest checking with the NAS manufacturer whether their devices have any Avast-related applications or settings that might trigger traffic classified under the "Avast_check" rule.

Please consult your NAS vendor to verify this possibility. If you have any further questions, feel free to share :)

GiuseppeR

Hi @Zyxel_Tina

sent you IP infos via PM, to avoid publishing them online for privacy.