AiProtection Logs

[chriseow]

May I know if AiProtection generate any logs when something has been blocked. For example, if I use Parental Controls, and access is blocked due to web activity, is this logged anywhere in the router? Reason is because I want to be able to find out all the violations generated by AiProtection, especially on DNS filtered and blocked websites.

 

[RMerlin]

AiProtection doesn't generate any log.

For DNSFilter, this is entirely handled outside of the router. All DNSFilter does is force DNS queries to go to a specified nameserver. If you use an OpenDNS account I believe they offer some kind of statistical tracking, but it won't be able to tell you which client on your network accessed what.

 

[chriseow]

AiProtection doesn't generate any log.

For DNSFilter, this is entirely handled outside of the router. All DNSFilter does is force DNS queries to go to a specified nameserver. If you use an OpenDNS account I believe they offer some kind of statistical tracking, but it won't be able to tell you which client on your network accessed what.

Thanks RMerlin! So there seems to be no way to track any form of violation using the Asus routers. You are right that if I use OpenDNS, there is some kind of reporting but not time specific unless I subscribe to their Umbrella program.

 

[martinr]

You know you can set up email alerts with AIProtection? I set up a dedicated gmail account for such emails. (I seem to remember you must enable 2-factir authentication for it to work.). Here's an example of the sort of the attachement you get with the alert email (I inserted xx:xx in mac address):

1130593 2016-10-05 19:03:26 00:27:10:xx:xx:70 TCP port 49761 is attacking 8.254.119.254 TCP port 80 ,this action has been blocked.

[This alert is caused by a program in Kaspersky anti-virus on my laptop.]

 

[chriseow]

You know you can set up email alerts with AIProtection? I set up a dedicated gmail account for such emails. (I seem to remember you must enable 2-factir authentication for it to work.). Here's an example of the sort of the attachement you get with the alert email (I inserted xx:xx in mac address):

1130593 2016-10-05 19:03:26 00:27:10:xx:xx:70 TCP port 49761 is attacking 8.254.119.254 TCP port 80 ,this action has been blocked.

[This alert is caused by a program in Kaspersky anti-virus on my laptop.]

Hi martinr, is the email alert only for "Infected Device Protection and Blocking" (under AiProtection Network Protection tab)? The Alert Preference appear only in that particular section... So I had thought that it is applicable for only that section. Do you get other alerts for Parental Controls and other functions under Network Protection?

 

[martinr]

The only other alert type I've had is when I (unwittingly) tried to contact a bad site: eg


2016-09-07 14:53:55 00:27:10:xx:xx:70 attempts to surf a limited website www.smartpcutilities.com ,the connection has been blocked.


That's not to say other alerts don't exist. It's probably fair to assume you'll get an alert if any of the elements of AIProtection spots a problem.

 

[chriseow]

The only other alert type I've had is when I (unwittingly) tried to contact a bad site: eg


2016-09-07 14:53:55 00:27:10:xx:xx:70 attempts to surf a limited website www.smartpcutilities.com ,the connection has been blocked.


That's not to say other alerts don't exist. It's probably fair to assume you'll get an alert if any of the elements of AIProtection spots a problem.

Hi martinr, you are right! I get notifications for all the other modules, including the Parental Control, although the warning message says it is a malicious site... At least now I know when violations occur. Thanks for the suggestion!


Sent from my iPhone using Tapatalk

 

[martinr]

You're most welcome, snd thanks for the feedback - it's good to have the confirmation.

Most importantly, you've solved your problem.