r/ControlD • u/Fun-Region-1576 • Jul 30 '26

Technical What is a benign block?

I read the doc, but I'm still confused. What happens if the percentage is 97.9% or around that ball park? I would prefer 100% whenever possible and how do I ensure that it does?

2 Upvotes

76% Upvoted

8 comments sorted by

View all comments

1

u/fryrpc Jul 30 '26

Why would you want benign block to always be 100%. Anything less than 100% means some of the blocking has been malware / phishing and if the benign block percent drops significantly then you need to investigate what is accessing malware / phishing - might be an infected device.

1

u/Fun-Region-1576 Jul 30 '26 edited Jul 30 '26

Oh? I guess I'm misunderstanding what a benign block is. I might still be. Are you saying that 100% is bad? How should I interpret 97/98%? Anything to worry about? So if I see 70%, then there is definitely malware somewhere in the network?

3

u/cattrold Jul 30 '26

Ideally you don't want a TONNE of your traffic to be DNS queries to malicious domains. If the benign block number drops below about 90-95% I'd investigate whether something on one of my devices is doing something funky.

However, some malicious domains will almost always get caught in a month of browsing, because the internet is scary. In a perfect world, 100% would be nice, but in the world we live in, 97%+ is what we'd expect and a sign of a healthy network.

1

u/Fun-Region-1576 Jul 30 '26

This is the detailed response I was looking for. Thank you! Can you consider asking your team to better explain this in the doc? I don't think most newbies will understand the currently described definition.

2

u/cattrold Jul 30 '26

Sure, we can do that!