What triggers 'Connected to safe ethernet' notification?

otse

While enabling computer's (Windows 8.1) network adapter to get ethernet working, which is a common task done hundreds of times on the same machine and the same (cable) internet connection, this time F-Secure SAFE showed a notification above the task bar that said "Connected to safe ethernet" (event is also visible in "Events"-list). There was indeed something unusual going on with the internet connection as Google send an exceptional security alert about suspicious log in as a result of logging in to a google account.

It took quite amount of time to investigate what was going on, but I couldn't determine neither that something suspicious was going on nor that everything was normal. The reason for Google's blocking was likely due to IP-based location being for some reason several hundred kilometers off (according to ISP such inaccuracies are possible). I checked F-Secure logs and the only thing I could found was the following text in DnsCheck.log:

I: DnsCheckHandler::OnDnsCheckFinished: >>> green flyer: Ethernet

So I would like to know what suddenly triggered F-Secure to show the "Connected to safe ethernet" message? The aim is to understand that was there perhaps something malicious going on with the internet connection. If documentation about the event is already available, a link would be appreciated.

[Deleted User]

Hi otse,

 

The message is coming from the built-in Router Checker in the product - which is showing the status when initially connecting to, or changing network.
Regarding Router Checker, you can check here.

The reason why F-Secure showed the message 'Connected to Safe Ethernet' is because the product may have detected a new or different network and reported the status.

otse

Thanks for the explanation. It, however, seems inadequate to answer the question thoroughly because as said, the usage pattern was the same as hundreds of times before and this was the first time I remember seeing this message; same computer, same cable network connection, same ISP, same modem as when the computer was used last time on the previous night. So what I was looking for was more information e.g. from F-Secure SAFE logs that what it saw differently this time given that the setup was identical as in previous day. If the answer is that it saw a different network, I guess the question is out of scope of SAFE's point of view, although some general explanation for dummies on what is 'different network' and why such happens if seemingly nothing has changed might still be relevant, but I would appreciate to hear if someone has an insight on what might have been going on with the network.

Ukko

Hello,

 

Sorry for my reply. Will be good if there official F-Secure Teams create response, but I just decided to add there my suggestion: that with my experience such "notification" as "Connected to safe..." can be triggered practically by something not critical as re-naming Ethernet Adapter, for example.

 

Maybe it can be something else (other changes);

 

For example, it valid for my experience. If I re-name network adapter, which was "there" (known) and already noted by F-Secure DNS Checker as safe one...  so with next launch system there will be fresh notification that "Connected to safe..." ;

But most likely your situation about something another (if some settings/configuration with changes?!);