У нас есть несколько Windows 10 рабочих станций — 6 из 20 — постоянно ударять URL «captive.apple.com/generate_204» по проводному доступу в Интернете. Это не вызывает каких-либо проблем, но мы не понимаем, почему его происходит, и мы хотим, чтобы отключить его.
Наши журналы FW дают нам эту информацию, которая может иметь отношение:
УДП: 6514
панорамирования: угроза
действие позволило
приложение: default_ports ТСР / 80
Приложение: has_known_vulnerability да
Приложение: риск 4
Приложение: подкатегория интернет-утилиты
Приложение: технологии на основе браузера
Приложение: tunnels_other_application да
Приложение: used_by_malware да
категория компьютерной и интернет-Инфо-
content_type текст / html
dest_interface Ethernet1 / 4
dest_zone глубинный рассеивающий слой
имя файла generate_204
пользовательских правил доступа в Интернет — приложение
We have a several Windows 10 workstation — 6 out of 20 — constantly hitting the url «captive.apple.com/generate_204» over wired internet. Its not causing any issues but we don’t understand why its happening and we want to turn it off.
Our FW logs give us this info which may be pertinent:
udp:6514
pan:threat
action allowed
rule User Internet Access — App
signature URL Filtering log(9999)
user_agent Mozilla / 4.0
1 Answer 1
Solved.. The GlobalProtect client for VPN access was hitting this «URL» to test for connectivity. I found out by eliminating what services were active on startup and it was the second one I tried.
Now we can eliminate this call-out as it is a trusted app that’s doing it with no payload anyhow.
So it wasn’t a browser but an embedded agent within the client
We have a several Windows 10 workstation — 6 out of 20 — constantly hitting the url «captive.apple.com/generate_204» over wired internet. Its not causing any issues but we don’t understand why its happening and we want to turn it off.
Our FW logs give us this info which may be pertinent:
udp:6514
pan:threat
action allowed
rule User Internet Access — App
signature URL Filtering log(9999)
user_agent Mozilla / 4.0
1 Answer 1
Solved.. The GlobalProtect client for VPN access was hitting this «URL» to test for connectivity. I found out by eliminating what services were active on startup and it was the second one I tried.
Now we can eliminate this call-out as it is a trusted app that’s doing it with no payload anyhow.
So it wasn’t a browser but an embedded agent within the client
Источник: