Is IP Shield block reported correctly?

MadPatrick · February 14, 2026, 2:23pm

Hi,

I see a large amount of block in the dashboard, but can not see this in the realtime monitor
I’m not sure, but it looks i appeared after the latest update this week

mrmarkuz · February 15, 2026, 8:59am

I can’t reproduce. Here the same count is shown in real time monitor.

To get a report about which blocklists were affected:

/etc/init.d/banip report

Maybe you can find more info in the logs about devices/blocklists, in the UI you could search for “banIP” or on CLI:

grep banIP /var/log/messages

MadPatrick · February 15, 2026, 9:09am

Hi grep banIP /var/log/messages

This looks normal

/etc/init.d/banip report
:::
::: banIP Set Statistics
:::
Timestamp: 2026-02-15 10:02:53
------------------------------
blocked syn-flood packets : 2564
blocked udp-flood packets : 2
blocked icmp-flood packets : 120
blocked invalid ct packets : 2442
blocked invalid tcp packets: 0
—
auto-added IPs to allowlist: 0
auto-added IPs to blocklist: 0

Set                  | Elements     | WAN-Input (packets)   | WAN-Forward (packets) | LAN-Forward (packets) | Port/Protocol Limit
---------------------+--------------+-----------------------+-----------------------+-----------------------+------------------------
allowlistv4MAC       | 0            | -                     | -                     | ON: 0                 | -
allowlistv6MAC       | 0            | -                     | -                     | ON: 0                 | -
allowlistv4          | 1            | ON: 0                 | ON: 0                 | ON: 0                 | -
allowlistv6          | 0            | ON: 0                 | ON: 0                 | ON: 0                 | -
bruteforceblockv4    | 434          | ON: 1                 | ON: 0                 | ON: 0                 | -
deblv4               | 16175        | ON: 47                | ON: 0                 | ON: 0                 | -
dshieldv4            | 19           | ON: 135               | ON: 1                 | ON: 0                 | -
deblv6               | 35           | ON: 0                 | ON: 0                 | ON: 0                 | -
greensnowv4          | 1566         | ON: 5                 | ON: 0                 | ON: 0                 | -
firehol1v4           | 3799         | ON: 37                | ON: 0                 | ON: 3                 | -
threatviewv4         | 3102         | ON: 1                 | ON: 0                 | ON: 0                 | -
ipsumv4              | 6505         | ON: 160               | ON: 0                 | ON: 0                 | -
urlvirv4             | 169          | ON: 0                 | ON: 0                 | ON: 0                 | -
uceprotect1v4        | 42772        | ON: 24                | ON: 4                 | ON: 0                 | -
webclientv4          | 210          | ON: 0                 | ON: 0                 | ON: 0                 | -
threatv4             | 75           | ON: 1                 | ON: 0                 | ON: 0                 | -
etcompromisedv4      | 44           | ON: 0                 | ON: 0                 | ON: 0                 | -
dropv6               | 86           | ON: 0                 | ON: 0                 | ON: 0                 | -
bogonv4              | 10           | ON: 0                 | ON: 0                 | ON: 0                 | -
bogonv6              | 36583        | ON: 0                 | ON: 0                 | ON: 0                 | -
torv4                | 889          | ON: 0                 | ON: 0                 | ON: 0                 | -
binarydefensev4      | 1271         | ON: 2                 | ON: 0                 | ON: 0                 | -
torv6                | 508          | ON: 0                 | ON: 0                 | ON: 0                 | -
blocklistv4MAC       | 0            | -                     | -                     | ON: 0                 | -
blocklistv6MAC       | 0            | -                     | -                     | ON: 0                 | -
blocklistv4          | 0            | ON: 0                 | ON: 0                 | ON: 0                 | -
blocklistv6          | 0            | ON: 0                 | ON: 0                 | ON: 0                 | -
---------------------+--------------+-----------------------+-----------------------+-----------------------+------------------------
27                   | 114253       | 23 (413)              | 23 (5)                | 27 (3)

Whay is see in the log is a lot of messege for ip 172.234.162.56

Feb 14 22:10:43 NethSecurity kernel: [598666.365244] banIP/pre-syn/drop: IN=eth1 OUT= MAC=5c:ed:8c:a4:63:69:00:01:5c:72:24:46:08:00 SRC=172.234.162.56 DST=24.132.194.112 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=23918 DF PROTO=TCP SPT=37516 DPT=4002 WINDOW=64240 RES=0x00 SYN URGP=0
Feb 14 22:10:43 NethSecurity kernel: [598666.365923] banIP/pre-syn/drop: IN=eth1 OUT= MAC=5c:ed:8c:a4:63:69:00:01:5c:72:24:46:08:00 SRC=172.234.162.56 DST=24.132.194.112 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=32683 DF PROTO=TCP SPT=48032 DPT=2382 WINDOW=64240 RES=0x00 SYN URGP=0
Feb 14 22:10:43 NethSecurity kernel: [598666.400440] banIP/pre-syn/drop: IN=eth1 OUT= MAC=5c:ed:8c:a4:63:69:00:01:5c:72:24:46:08:00 SRC=172.234.162.56 DST=24.132.194.112 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=20404 DF PROTO=TCP SPT=41750 DPT=6512 WINDOW=64240 RES=0x00 SYN URGP=0
Feb 14 22:10:43 NethSecurity kernel: [598666.401421] banIP/pre-syn/drop: IN=eth1 OUT= MAC=5c:ed:8c:a4:63:69:00:01:5c:72:24:46:08:00 SRC=172.234.162.56 DST=24.132.194.112 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=53890 DF PROTO=TCP SPT=57516 DPT=56019 WINDOW=64240 RES=0x00 SYN URGP=0
Feb 14 22:10:43 NethSecurity kernel: [598666.402215] banIP/pre-syn/drop: IN=eth1 OUT= MAC=5c:ed:8c:a4:63:69:00:01:5c:72:24:46:08:00 SRC=172.234.162.56 DST=24.132.194.112 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=58923 DF PROTO=TCP SPT=60716 DPT=3388 WINDOW=64240 RES=0x00 SYN URGP=0
Feb 14 22:10:43 NethSecurity kernel: [598666.494573] banIP/pre-syn/drop: IN=eth1 OUT= MAC=5c:ed:8c:a4:63:69:00:01:5c:72:24:46:08:00 SRC=172.234.162.56 DST=24.132.194.112 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=34423 DF PROTO=TCP SPT=48878 DPT=38001 WINDOW=64240 RES=0x00 SYN URGP=0
Feb 14 22:10:43 NethSecurity kernel: [598666.529280] banIP/pre-syn/drop: IN=eth1 OUT= MAC=5c:ed:8c:a4:63:69:00:01:5c:72:24:46:08:00 SRC=172.234.162.56 DST=24.132.194.112 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=26571 DF PROTO=TCP SPT=44760 DPT=9217 WINDOW=64240 RES=0x00 SYN URGP=0

mrmarkuz · February 15, 2026, 9:52am

Did you maybe enable logging of all kind of packets in the settings?

The following is the command to get the blocked IPs in the dashboard.
All bans, drops and rejects from the last hour are counted.

grep -e "$(date -d '-1 hour' +'%b %e %H:%M')" -e "$(date  +'%b %e %H:')" /var/log/messages | grep -E 'banIP.+add IP|banIP.+drop|banIP.+reject' | wc -l

MadPatrick · February 15, 2026, 10:06am

Yes.

But the number should then still be the same ?
What is in the realtime monitor should be the same as the dashboard

grep -e “$(date -d ‘-1 hour’ +‘%b %e %H:%M’)” -e “$(date +‘%b %e %H:’)” /var/log/messages | grep -E ‘banIP.+add IP|banIP.+drop|banIP.+reject’ | wc -l
date: invalid date ‘-1 hour’
85039

mrmarkuz · February 15, 2026, 10:36am

From the code I think the real time monitor just counts added banned IPs whereas the dashboard also counts logged drops and rejects.

MadPatrick · February 16, 2026, 7:18pm

Still strange. I never had these high number in the dashboard
I changed the setting of logging in IP shield

In the relatime monitor i’m now having less logs, but the dashboard remains high

I’m pretty sure this happend after an update last week

Jack95 · February 21, 2026, 11:20am

Good morning everyone, I too have noticed a significant increase in blocked IPs on threat shield ip, yesterday I restarted the firewall to try to understand, now it has been active for about 20 hours, and I see that hour by hour the count continues to rise, usually I saw an hourly average between 1000/1500 blocked IPs now we are above 11500 blocked IPs, I have the impression that in the dashboard they are not counted correctly.

Jack95 · February 22, 2026, 7:11am

Good morning, for an update, these are the values from this morning. As I mentioned in the previous post, the firewall has now been on for 1 day and 15 hours. The value on the dashboard continues to increase.

MadPatrick · February 22, 2026, 8:48am

Issue reported on Git

Tbaile · February 23, 2026, 9:29am

We haven’t touched BanIP during latest updates, I’ll take a look if these values can be merged together nicely (probably not)

This might not be fixed in the immediate times, but since I’m working on monitoring and such, this can be one of the first things I can put hands on to unify.

Tbaile · February 24, 2026, 4:05pm

Heads up on this, seems that the package that handled date was incorrectly removed, the issue is just visual, the blocking works fine. I’ve updated the issue that @MadPatrick gently provided.

github.com/NethServer/nethsecurity

ThreatShield dashboard block count is incorrect

opened 08:48AM - 22 Feb 26 UTC

MadPatrick

**Steps to reproduce** 1. Check IP Shield block count shown in Dashboard. 2. Up…date NethSecurity 8.7.1 to latest packages using the interface. 3. Observe that after update, the command shows an invalid date error and the count diverges from actual blocks and UI indication. 4. You can figure out actual active blocks using this command: `/etc/init.d/banip report text` beware, counting might vary from real scenarios. The count no longer matches events found in real-time logs or with manual count commands. This is caused by the removal of `coreutils-date`, leading to incorrect behavior of scripts expecting the GNU date syntax. When `coreutils-date` is missing and only busybox date is present, parsing with constructs like `date -d '-1 hour'` fails, breaking block count and counting all occurrences in the logs. This is a **cosmetic issue**, blocking IPs and reporting to controller aggregations are not affected. **Components** - NethSecurity version: 8.7.1 **See also** - https://mattermost.nethesis.it/nethesis/pl/of5t8hd7kp85bdj3fnkim9cqao - https://community.nethserver.org/t/is-ip-shield-block-reported-correctly/26945

MadPatrick · February 24, 2026, 6:23pm

Thanks for confirming the bug and solving it
I’ve updated with the following updates

Bug and security fixes to update

netifyd 2025.10.01-5.1.25-r3 to 2025.10.01-5.1.25-r4
ns-api 3.5.0-r1 to 3.5.1-r2
ns-dpi 0.3.0-r1 to 0.3.1-r1
ns-phonehome 0.0.7-r1 to 0.0.8-r1
ns-plug 1.0.1-r1 to 1.0.2-r1
ns-ui 2.13.1-r1 to 2.14.0-r1
python3-nethsec 1.4.8-r1 to 1.5.1-r1
rsyslog 8.2110.0-r1 to 8.2506.0-r2

Is this update with the fix included ?