2 files changed, 15 insertions, 7 deletions
diff --git a/bin/net_applet b/bin/net_applet
index c3b7ddc..5be9c67 100755
--- a/bin/net_applet
+++ b/bin/net_applet
@@ -538,22 +538,28 @@ sub apply_verdict_whitelist {
 }
 
 sub handle_ifw_message {
-    my $attack = network::ifw::attack_to_hash(\@_);
-    unless ($attack->{msg}) {
+    my $message = network::ifw::attack_to_hash(\@_);
+    unless ($message->{msg}) {
         print "unhandled attack type, skipping\n";
         return;
     }
-    enable_ifw_alert();
+    my $is_attack = $message->{prefix} ne 'NEW';
+    enable_ifw_alert() if $is_attack;
     $bubble_queue->add({
         title => N("Interactive Firewall"),
         pixbuf => $pixbufs{firewall},
-        message => $attack->{msg},
+        message => $message->{msg},
         timeout => sub {
-            set_verdict($attack, \&apply_verdict_ignore);
+            set_verdict($message, \&apply_verdict_ignore);
         },
         clicked => sub {
-            disable_ifw_alert();
-            ask_attack_verdict($attack);
+            if ($is_attack) {
+                disable_ifw_alert();
+                ask_attack_verdict($message);
+            } else {
+                set_verdict($message, \&apply_verdict_ignore);
+                $bubble_queue->process_next;
+            }
         },
     });
 }
diff --git a/lib/network/ifw.pm b/lib/network/ifw.pm
index 44f58da..1148605 100644
--- a/lib/network/ifw.pm
+++ b/lib/network/ifw.pm
@@ -129,11 +129,13 @@ sub attack_to_hash {
         $attack->{prefix} eq 'SCAN' ? N("Port scanning")
       : $attack->{prefix} eq 'SERV' ? N("Service attack")
       : $attack->{prefix} eq 'PASS' ? N("Password cracking")
+      : $attack->{prefix} eq 'NEW' ? N("New connection")
       : N(qq("%s" attack), $attack->{prefix});
     $attack->{msg} =
         $attack->{prefix} eq "SCAN" ? N("A port scanning attack has been attempted by %s.", $attack->{hostname})
       : $attack->{prefix} eq "SERV" ? N("The %s service has been attacked by %s.", $attack->{service}, $attack->{hostname})
       : $attack->{prefix} eq "PASS" ? N("A password cracking attack has been attempted by %s.", $attack->{hostname})
+      : $attack->{prefix} eq "NEW" ? N("%s is connecting on the %s service.", $attack->{hostname}, $attack->{service})
       : N(qq(A "%s" attack has been attempted by %s), $attack->{prefix}, $attack->{hostname});
     $attack;
 }