Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 33 replies
  • Answers 2 answers
  • Subscribers 14 subscribers
  • Views 82538 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSP.exe creating lots of traffic

IanTaylor

We have been investigating issues with our firewalls and one thing I noticed is i have been seeing hundred and hundred of hits from ssp.exe to our firewall

Client base is over 500!


These seem to be amazon IP Address, why is it talkign too these and what is ssp.exe?



This thread was automatically locked due to age.
  • 0 in reply to CraigJones

    Hi Craig,

    Thank you very much for all of that information. The query about disabling it has been born from the SSP service being blamed for causing performance issues through our Firewall so we wanted to be ready to disable it if necessary. We fully understand why it is needed and don't want to disable it but we were close to being asked to.

    I would just like to mention that we are also seeing the SSP service contacting AmazonWS addresses in our FW logs so would also be interested in anything you can determine from Paul's FW logs.

    Thanks again

  • 0

    Same issue here, the SPP Service is killing our Sophos UTM with more than 400000 blocked reqests on Port 80 instead of 8080.

    We need a Hotfix for this immediatly. Our entire network is collapsing because of this fail feature !!!

  • 0 in reply to AdministratorSKN

    OK, SSP uses port 443. Can you allow 443 out to 4.sophosxl.net?

    Can you let me see some of your logs? Pm me.

  • 0 in reply to CraigJones

    Same issue as of 10.6 update. Sophos support stated we can clear the check box for "Detect malicious behavior" to stop this traffic. This does not seem to be correct as this setting is already disabled in one of our A/V policies yet we are seeing traffic coming from those endpoints.

    For now, we have elected to stop the new Sophos service on the endpoints until we have an way to disable this via Sophos policies.

  • 0 in reply to CraigJones

    Hi Craig, 4.sophosxl.net is allowed for http, https, and dns traffic in our UTM firewall. We also added it to the skip proxy auth. rule for this url.

    But there is still thousands of packets sent directly to our Sophos UTM. Thist traffic instantly stops when i disbale the SSP service on

    the monitored endpoint. i dont understand why the service keeps sending the packets directly to the UTM appliance insted of sending it to 4.sophosxl.net.

  • 0 in reply to AdministratorSKN

    Hi, what mode is your UTM proxy in? 

  • 0 in reply to AdministratorSKN

    Ok, 4.sophosxl.com is HTTPS only.

    We are going to do a few tests on this later today/tomorrow.

    Try a rule that allows:

    80,443 --> *.sophosxl.net

    https://community.sophos.com/kb/en-US/117936

    DNS requests will be done by the local DNS server, so the Endpoint will query the configured DNS server then the DNS Server will lookup to us. So that traffic will be separate.

     

  • 0 in reply to CraigJones

    Hi Craig, we have added the rule. Our Proxy runs in default mode with active directory SSO authentification. SSL is in URL only mode.

  • 0 in reply to CraigJones

    Hi Craig,

    To return to the 4.sophosxl.net address returning as an Amazon AWS address, I get the following from an nslookup on our web filter:

    "DNS Lookup for 4.sophosxl.net (4.sophosxl.net) returns:    54.246.172.45    52.50.177.117    52.51.158.42    52.30.113.180    52.30.190.178    52.48.62.119    54.76.67.12    52.18.100.124"

    When I use MXToolbox.com to reverse lookup all of those IP addresses, they all come back as an amazonaws.com address.

    Similarly when I complete a DNS Lookup on MXtoolbox.com on "4.sophosxl.net" it returns completely different IP addresses:

    Is this all correct?

    Thanks

    Martin

  • 0 in reply to Papadug

    That's all correct, it's a massive load balanced system, so it will return multiple AWS addresses.

    Best,

    Craig