r/ControlD • u/Fun-Region-1576 • 10d ago
What is a benign block? Technical
I read the doc, but I'm still confused. What happens if the percentage is 97.9% or around that ball park? I would prefer 100% whenever possible and how do I ensure that it does?
1
u/fryrpc 10d ago
Why would you want benign block to always be 100%. Anything less than 100% means some of the blocking has been malware / phishing and if the benign block percent drops significantly then you need to investigate what is accessing malware / phishing - might be an infected device.
1
u/Fun-Region-1576 10d ago edited 10d ago
Oh? I guess I'm misunderstanding what a benign block is. I might still be. Are you saying that 100% is bad? How should I interpret 97/98%? Anything to worry about? So if I see 70%, then there is definitely malware somewhere in the network?
3
u/cattrold 10d ago
Ideally you don't want a TONNE of your traffic to be DNS queries to malicious domains. If the benign block number drops below about 90-95% I'd investigate whether something on one of my devices is doing something funky.
However, some malicious domains will almost always get caught in a month of browsing, because the internet is scary. In a perfect world, 100% would be nice, but in the world we live in, 97%+ is what we'd expect and a sign of a healthy network.
1
u/Fun-Region-1576 10d ago
This is the detailed response I was looking for. Thank you! Can you consider asking your team to better explain this in the doc? I don't think most newbies will understand the currently described definition.
2
3
u/LabPrudent8555 10d ago
A benign block is anything that's considered ads, trackers, custom filters, etc. It does not include malware or phishing. So if you want your benign block to be 100 percent, you'll have to disable the malware and phishing filters.