-
June 3rd, 2003, 05:23 AM
#1
Member
my firewall is crazy!
my firewall is insain, or just im odd
so almost every hour or so, i get a ATTACK ALERT from my firewall(its norten) sayin that i have been attacked and its been blocked, should i worry about this, or is it common, and it isn't always just a person, could it be a automatic computer doin it?
-
June 3rd, 2003, 05:48 AM
#2
Personally, I think that it is a good thing. Your firewall is blocking incoming traffic, and doing what it is designed to do!
If the alerts are annpying you, there should be a function on your Firewall to stop the pop-up alters from happening, but I cannot say definitavely without knowing what firewall you are using.
SoggyBottom.
[glowpurple]There were so many fewer questions when the stars where still just the holes to heaven - JJ[/glowpurple] [gloworange]I sure could use a vacation from this bull$hit, three ringed circus side show of freaks. - Tool. [/gloworange]
-
June 3rd, 2003, 05:52 AM
#3
Member
Yeah I would be happy to see so many alerts, it's a good sign of your firewall doing exactly what it was meant to do. As SoggyBottom said there should be an option to disable the pop ups if they do tend to get annoying.
-
June 3rd, 2003, 06:53 AM
#4
Member
thanks, is every attack an attack by a hacker so to say? or just something else¿
<s>all your base are belong to us!
-
June 3rd, 2003, 07:20 AM
#5
Originally posted here by theyortiscool
thanks, is every attack an attack by a hacker so to say? or just something else¿
umm, a Hacker, no, a cracker or script kiddie, maybe.
It depends on what kind of attack it says its blocking. if you paste some of the logs in and we can look then maybe we could tell what they are.
-
June 3rd, 2003, 07:56 AM
#6
usually its not an attack at all or at least not by a person. your fw reports any attempt to connect as an attack even if its legit. does norton tell you the port and protocol? many attempts to connect are internet worms looking for servers to infect. sql iis or other. if you consider these 'attacks' i guess you could say your being attacked. if you can give more info im sure someone will tell you what it is
Bukhari:V3B48N826 “The Prophet said, ‘Isn’t the witness of a woman equal to half of that of a man?’ The women said, ‘Yes.’ He said, ‘This is because of the deficiency of a woman’s mind.’”
-
June 3rd, 2003, 09:36 AM
#7
Dont be worried that your computer is saying its blocking attack, worry when it stops saying that it is blocking attacks. lol
-
June 3rd, 2003, 10:13 AM
#8
Re: my firewall is crazy!
Originally posted here by theyortiscool
my firewall is insain, or just im odd
so almost every hour or so, i get a ATTACK ALERT from my firewall(its norten) sayin that i have been attacked and its been blocked, should i worry about this, or is it common, and it isn't always just a person, could it be a automatic computer doin it?
I would say it is definitely an automatic attack, if indeed an attack at all. Either:
- You are genuinely being attacked, almost certainly by a worm. Almost certainly by either an IIS worm or SQL Slammer (which is dead now 99% of ISPs block it?)
or
- Your firewall is detecting legitimate traffic as an attack.
The second is fairly likely. Some of these Windoze application firewalls are amazingly paranoid by default and classify any connection as an attack unless it matches some rule for legitimate traffic. This is rediculous. A real IDS would probably not see these as attacks.
For example, a straightforward ping could be seen as an attack by your firewall, but many things legitimately ping client boxes (perhaps to determine latency)
One other thing:
Are you running P2P or have you been recently? If so then ignore *ANY* IDS. P2P vs IDS is a battle IDS cannot win.
-
June 3rd, 2003, 02:20 PM
#9
Donn't your firewall gives you more details about the dropped flows.
Maybe it's simple scans - then you can't do a lot and pray that the scanner is not handled by a kid.
Maybe it is a real attack - & then you should worry, investigate and take counter measures.
If you don't know where to start I'm sure by publishing your logs (:!: hide your public addys) on AO, some folks will help thanx to their expertise.
[shadow] SHARING KNOWLEDGE[/shadow]
-
June 3rd, 2003, 07:36 PM
#10
Member
yeah, it can tell me what the ip adress is of the person who is attackin me. when i click on more info it tells me that it is a inbound trojan horse. but i scan for virus's and none is detected. i did have THE CLEANER but my 30 day trial ran out. is there any other programs that can clean and delet any trjans that are on my pc.
and i do run the occasual P2P(kazaa)
<s>all your base are belong to us!
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|