Why is Mozilla showing as Application even though no Mozilla product installed?

[AnthonyTechGuy]

In the past 1 week, "Mozilla" is showing as a Top Application by usage, at all our sites.  It's using about 3% - 9% of bandwidth overall, spread out across most computers.  Network Wide > Clients > Application Details.  When drilling down, all clients are accessing Mozilla, as reported by Meraki MX.  This is showing under Meraki portal and Meraki Emailed Reports.

We do not use any Mozilla product, nor have any product installed.  People have no need to go to Firefox, or Thunderbird, etc.  According to this page, this is the list of products they provide.

https://support.mozilla.org/en-US/products/

Mozilla using 3% - 9% of companywide bandwidth is huge, considering we never use any Mozilla product.

I've never seen this before, as I can almost always attribute a reported application to a known service we use.  Any advise?  Anyone seeing this themselves?  I can't figure out if:

1)  This is a Meraki mismatch.

2)  These are tracking cookies Mozilla embeds into other websites, like a lot of data collectors do nowadays.  (i.e. Google, or Facebook cookies).

3)  Something else?

[PhilipDAth]

Do you have guest or staff WiFi?  Could it be on one of those mobile devices?

When you lick on it and device in - what device(s) does it say is generating the traffic?

[AnthonyTechGuy]

Thanks for your thoughtfulness,

I was able to drill down and check which Clients were contributing to this sudden Mozilla use.  It's dozens of our own domain joined computers, which are locked down (cannot install apps themselves).  This is across all our MX appliances, across all locations.  Our central asset management system detects NO Mozilla installations.  It's a real time inventory management system, able to detect software.

The Meraki simply detects it as "Mozilla", under the application list.  By adjusting the time, (1 week VS 1 Month) I can clearly see this was not detected until about 1 week ago.

[PhilipDAth]

Does Organization/Firmware upgrade show any firmware updates a week ago?

It sounds like a false positive ...

[AnthonyTechGuy]

No updated in the past 30 days.  This started on Feb 13th.  Then traffic from Mozilla detected ever since.  Drilling down, i can see it's all from ftp.mozilla.org.  Most traffic was Received, almost no traffic Sent.

[BlakeRichardson]

I would open a support ticket. If you are not using Firefox what are you using? 

Please don't say Edge 🤣

[KarstenI]

---

@PhilipDAth wrote:

When you lick on it and device in - what device(s) does it say is generating the traffic?

---

Licking your AP could get you a free AP:

[AnthonyTechGuy]

All Windows computers are "contributing to this rule".  

[AnthonyTechGuy · Accepted solution]

Solution was the scroll all the way down past the (long list) of contributing clients. At the very bottom was the URL that was generating the traffic, ftp.mozilla.org.  Drilling down too far, (clicking on any of the clients itself) does not show the URL that's being reported as Mozilla.  After research, turns out one of our tools had an update that caused it to generate unnecessary amounts of traffic, for an unneeded product.  All good!