Firewall questions

[spyguy1010]

I just installed a firewall for the first time. And now i get alerts every minute, sometimes every few seconds. What i don't understand is, are all these alerts someone attempting to gain access to my PC, or some sort of "traffic?"
I'm connected through a LAN, and i have WIN/98se. Will someone please give me some insight as to what i'm experiencing.

[tampabay420]

please copy&paste the exact messages/alerts you are getting?
what brand of firewall?

[jaguar291]

I'm assuming you are using ZA, correct me if I'm wrong but it doesn't matter...

Those alerts could mean a variety of things... it all depends what the alert says.. some report to you that programs are trying to access the internet (i.e LiveUpdate from Norton, etc.) but others are alerts that someone is trying to scan your ports, some mean that someone is sending packets (ping) to your computer... you just have to read them and read about them online... and most importantly it is nothing you have to worry about .. its normal and you will be getting a lot of these..

Most people will add more good info...

[kilerboots]

If your useing ZA make sure they are not just alerts asking you if you would be alright for a program to run... usually there is a check box that says always allow this program to have access. You can check that for mostly everything that you use so you wont get the little pop-up thing.

Read the full message you get... because maybe your just going to a web page and the alert asks you if you want it to have access.

[spyguy1010]

the alerts i get are concerning TCP and UDP and ICMP.

I do understand about application filtering, or which programs are allowed to access the internet. It's just the alerts that i don't quite get.

I should also ask.......what is a "TCP packet?"

[journy101]

As stated it realy depends on the alerts themself as to weather they are normal trafic or malicious. But it sounds like you are new to firewalls that that these alrets are just trafic. If you are using ZonAlarm you need to disable alerts. It just means you wont see the alert, and it will silently block or alow conections.

For programs that make conections to the internet, is simple. If the program needs to use the internet, typicaly you create a filter/rule for that port used. For Your web browser like Netscape, create the rule for port 80, 8080, 8088 and 21. Because there will be many computers it will need to conect to. For AntiVirus updates need to conect to a server to download the update, but there typicaly is only a few servers for this update, so in that case I would say create the rule for the ip address instead.

[KeyserSoze]

I should also ask.......what is a "TCP packet?"

Basically, it is just a piece of data that is recognized by your computer and can be moved from application to application, usually from the internet to a program on your computer or vice versa. TCP/IP is a whole suite of protocols that are used for moving data. IP moves data between "host" computers on the internet, and TCP takes that packet (data) from IP and routes it to the correct application on your computer so it can be used.
Clear as mud?
Take a look at this page . Hopefully it will answer your questions about TCP, UDP, and ICMP. As tampabay420 said, you really need to post the log messages before anyone could help you out. A lot of the warnings are probably innocuous, but some could be important. And all need to be learned.

[kilerboots]

I should also ask.......what is a "TCP packet?"

Abbreviation of Transmission Control Protocol
TCP is also one of the main protocols in TCP/IP networks.
TCP enables two hosts to establish a connection and exchange data. IP protocol deals only with packets.
TCP packets will be delivered in the same order in which they were sent.