Skynet Skynet/BanAiProtect interaction when AiProtect features off but Privacy Agreement active vs. Withdrawn from Privacy

[aex.perez]

Curious on the "BanAiProtect" feature. I had NOT withdrawn from the TrendMicro privacy agreement but I did have the AIProtect features disabled:

• Malicious Sites Blocking
• Vulnerability Protection
• Infected Device Prevention and Blocking

I noticed that there was a outbound destination that was logged, blocked and labled "BanAiProtect". Even though the AIProtect features are off, but you are not withdrawn from the privacy agreement, will this turn on those AIProtect features one has disabled?

I ask because in testing bandwidth at the router with spdMerlin, whenever I enable a AIProtect feature I see a bandwidth drop. When I disable the feature, my bandwdith returns. I saw the bandwith drop all of a sudden, and saw all TrendMicro related feature were still off. But in this case I had to acturally withdraw from the privacy agreement to get my performance back even though the AIProtect features were still disabled in the router. As soon as I withdrew my consent my performance returned. Unfortunately I only pulled the system log, I did not get the timestamp of the ban to correlate with the time of the bandwidth drop. I didn't get before and after running processes out of scMerlin either. I did have "Import AiProtect Data" enabled in and was filtering all traffic.

Just for clarity, bandwith results on AX88U / 1Gb Fiber - results with 384.19 or 386.1 B4b - observation occurred with 386.1 B4b
~930D/~930U without Skynet
~920D/~910U with Skynet (outbound only)
~910D/~600U with Skynet (all)
~400D/~500U (no not reversed) Skynet (all) and TrendMicro feature (one or several) enabled

Attached, what it looked like when it happened, returned to normal when withdrawn from Privacy agreement...

Trying to methodically recreate what I saw happen but I figured I'd ask the question. If the "BanAiProtect" might've of triggered the use of AiProtect features even though I had them off at the Router but had not withdrawn from the privacy agreement?

 

[JaimeZX]

I don't think so. BanAIProtect just adds any [edit: IP address] that AIProtect hits on to the Skynet blacklist. AFAIK It doesn't otherwise interact with any of the TrendMicro code (which IIRC is closed-source anyway.)

 

[aex.perez]

Maybe I was grasping at straws but I couldn't ignore the coincidence. It was too obvious to ignore with how it immediately resolved itself once I withdrew from the privacy agreement. I also doubled checked everything AiProtect/TrendMicro related was disabled too.

I'll setup the same conditions and try to recreate it. If only to rule out my curiosity. At least I know what to collect this time if it happens again... With my luck, it won't and I be left scratching my head trying to figure out how it occurred.

 

[JaimeZX]

Killer speeds, btw. Any reason you have AIProtect off?

 

[aex.perez]

Was attempting to isolate what was causing the dropoff on bandwidth and what causes it with 384.19 / 386.1 B3 / 386.1 B4b. That's how I noticed AiProtect got turned on even though all of AiProtect was disabled, the drop in bandwidth. There's not much impact at the PC, pretty consistently over ~920 in both directions regardless of what's enabled at the router/scenario tested. Speedtest comes in at 1/2 when anything TrendMicro is enabled. Normally, with Skynet filtering in and outbound its ~920Mbps down, ~600Mbps up. Just surprised at how low the results are with anything TrendMicro enabled, but then again that's how I spotted the anomally in my results.

 

[SomeWhereOverTheRainBow]

Was attempting to isolate what was causing the dropoff on bandwidth and what causes it with 384.19 / 386.1 B3 / 386.1 B4b. That's how I noticed AiProtect got turned on even though all of AiProtect was disabled, the drop in bandwidth. There's not much impact at the PC, pretty consistently over ~920 in both directions regardless of what's enabled at the router/scenario tested. Speedtest comes in at 1/2 when anything TrendMicro is enabled. Normally, with Skynet filtering in and outbound its ~920Mbps down, ~600Mbps up. Just surprised at how low the results are with anything TrendMicro enabled, but then again that's how I spotted the anomally in my results.

From My understanding, this is probably due to trendmicro placing itself infront of traffic playing gatekeeper. It probably impacts the overall throughput.

 

[aex.perez]

From My understanding, this is probably due to trendmicro placing itself infront of traffic playing gatekeeper. It probably impacts the overall throughput.

Looks like that even if you have all the features disabled, but have still not withdrawn privacy, after about 18 hours it turns itself on. Only way to disable it at that point, since all features are already disabled it to withdraw the privacy agreement.