Fix: Computer getting slow after recent update

[ArmandMeppa]

Notification from a few Adorsys employees this morning:

Good morning,
Off Topic Trigger!!!
Is anyone else having problems using Safari or Chrome right now? I did the Wazuh update yesterday and
now I have to literally cheer for the web pages to load. Everything is super slow :disappointed:
And PS: Yes, I restarted my computer, cleared my browser cache, and I'm not on an ISDN line.
1. Torsten Klement  [10:20 AM]
       I stopped the Wazuh client on my Mac
       [10:20 AM] After that, everything is back to normal
       OS: macOS 26.x
2. Jan Fuchsmann
      Today at 8:27 AM
      It messed up my internal DNS so badly that nothing worked anymore. So yes.

TODOs:

• Find what is the source of the problem
• Fix it

[MarantosGeorge]

What resolved network issues

Wazuh Agent was stopped
using sudo /Library/Ossec/bin/wazuh-control stop

Information about users machine

Release: 1.6.0
Chrome: Version 141.0.7390.77 (Offizieller Build) (arm64)
Safari: Version 26.0.1 (21622.1.22.11.15)
macOS Tahoe Version 26.0.1
Apple M3 Pro
Approximate time/date when the issue occurred: last 24 hours i.e 14 October - 15 October

Investigation

Last Events/Alerts generated on wazuh dashboard:

From ChatGPT:
Suricata monitors network traffic and matches it against rules (usually from sources like Emerging Threats or custom rules).
The “TCP Scan” alert typically comes from reconnaissance detection rules, which identify patterns consistent with someone probing your system to see which TCP ports are open.

This doesn’t necessarily mean a successful attack — it’s more like an early warning that something or someone is scanning your system.

[MarantosGeorge]

Snort is still listed as a startup application on Torsten's macOS. Will sync to stop and uninstall Snort.

[ArmandMeppa]

Will have a sync with Torsten for a possible solution

[ArmandMeppa]

Couldn't sync with Torsten yesterday, will sync on Friday

[MarantosGeorge]

Synced with Torsten Yesterday, Asked him to start wazuh-agent and restart agent-status client to reset memory usage. (Was 1.8GB)

Today he notified me that he faced same issue again. Therefore stopped wazuh-agent.

• Will ask to stop Suricata, and start wazuh-agent service to test if Suricata logs are the issue.

[MarantosGeorge]

Torsten Stopped Suricata, Wazuh Agent is running. To determine if Suricata/Suricata logs are the issue.

[MarantosGeorge]

Current Status

• Torsten issue has not come up yet with Suricata stopped and wazuh agent running.

To Do

• Identify where TCP Scan ? logs are coming from.

[ArmandMeppa]

Still looking for the source of the suricata alert flooding the network

[MarantosGeorge]

Investigation

The frequent TCP Scan ? alerts were traced back to Torsten's local router sending routine single-packet SYN probes to common service ports.

To Do

• Look into source port from router

[MarantosGeorge]

Update – Investigation Summary

We analyzed multiple Suricata alerts (sid: 992002087, “TCP Scan ?”) triggered by one of the monitored agents.
All alerts originated from the local gateway (internal IP) targeting the agent on common web service ports (80, 443, 8080, 8081).

Packet inspection shows single SYN packets from random high (ephemeral) source ports, consistent with normal client connection behavior, not an active scan. The connections occurred in short bursts, likely caused by gateway liveness checks or internal service discovery traffic.

Conclusion: These are false positives triggered by an overly broad Suricata rule that alerts on any SYN packet.
Next steps:

Adjust rule 992002087 to include a detection_filter (e.g., trigger only after ≥10 SYNs in 5s).

Optionally exclude known web ports [80,443,8080,8081] or suppress traffic from the internal gateway.

This tuning will reduce alert noise while maintaining valid scan detection accuracy.