Non-Internal GRE Network Connection Detected

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•2

Detects network connections using the GRE (Generic Routing Encapsulation) protocol destined for non-internal (outside of RFC 1918) IP addresses. GRE is frequently used for tunneling traffic and, when used to communicate with external hosts, may indicate unauthorized tunneling or data exfiltration.