September 15th, 2003, 06:24 AM
getting pinged repeatedly
I am new to this website. I would like to know if anyone can tell me what I should do to prevent someone from constantly pinging me. I am using a blue and white g3 mac. I have a cable internet connection. I have a firewall which has recently been alerting me that someone is attempting an intrusion. Most of the intrusions are coming from Canada. I live in the U.S. When I check the ip address of where the pings are coming from using showmyip.com it only provides the "last" point of origin.
I would like to know how I can prevent someone from constantly trying to intrude on my computer. It's annoying. Better yet, how can I find this person or people doing this ?
Your help is much appreciated.
September 15th, 2003, 06:30 AM
What firewall are you using? Most have the option of blocking all ICMP traffic, which would be relevant to your case.
You shouldn't worry about these pings to much (unless they are coming at a rapid pace, of course). You probably are running some service that sends out packets checking for connectivity, or something along those lines
It\'s 106 miles to Chicago, we\'ve got a full tank of gas, half a pack of cigarettes, it\'s dark and we\'re wearing sunglasses.
September 15th, 2003, 06:40 AM
yeah i would check to make sure that your firewall, is working.
I had this idea from what i read that maybe this person is trying to overload your computer to make it crash.
I had someone try that, and i ended up gettting there ip and i contacted the relevant people and they had there connection disconected.
So don't worry about getting revenge or anything.
Me best opinion would be to check your firewall for any sort of problems and i would recommend in purchasing the macfee firewall.
I recently purchased the latest version, and tried to hack into my own system through a friends computer and i couldnt get anywere.
And them pinging you they are most likely tryin to get information to maybe attempt an attack.
But i would not worry, as it sounds like your firewall might be just enough to hold them off.
Please correct me if what i have said is wrong.
As i am still learning myself about computer security.
September 15th, 2003, 07:09 AM
Ok, it also maybe nothing. high speed ISPs often check on connections to the customers as part of daily life. If your ISP has offices in canada, that MAY be why. Also, instead of "blocking" the packets, try seeing if your firewall will "drop" them. That way if someone is actually trying to break in, they wont even know you exist. Staying in the shadows online is safer than jumping out and saying "got ya!"
So basically, check with your ISP and see if it's them, and also, try dropping the packets instead of blocking them. But as I said, alot of high speed ISPs do ping and check a few things on customers, so it may be nothing at all.
September 15th, 2003, 11:07 AM
You might like to try http://grc.com (Gibson Research Corporation) and try their firewall test?
If your firewall is monitoring all ports and has them in "stealth mode" the pings won't get a reply, so your machine will remain undetected.
Sam Spade v1.14 is quite a useful (free) internet analysis tool you should be able to find a local download site via Google.
I believe that the Walechia worm uses multiple pinging to look for vulnerable machines..............I was getting at least 500 per hour a few days ago. Most of these coming from other addresses within my ISP.
Are these pings all coming from the same address, or different ones? By "the same" I mean are the first two sets of the address the same. If the last two sets are different, then it sounds like the worm. If the numbers are all the same it sounds like someone/thing is out to get you?
I hope your firewall is monitoring for OUTGOING as well as incoming connections? There might be something on your machine that is starting these dialogues?
EDIT: The firewall test ought to work on a Mac, but I am not sure about sam spade?
Hope this helps
September 16th, 2003, 05:34 AM
Thank you all for your suggestions. Here are the answers to your questions and what I did regarding your suggestions.
I went to the site grc.com and tested my computer connection's security. Everthing was fine except I had not set the firewall to Stealth, which resulted in the website being able to ping me. When I checked off Stealth Mode in Options to prohibit ping replies I ran the test again and the report came back perfect TruStealth rating no packets solicited were replied to.
I am presently using Netbarrier the latest version for Macs. McAfee appears to be only for Windows, also Samspade appears to be for windows.
I must say this pinging started a few days ago since having cable internet for almost two months now. Don't understand what brought it on.
The pings are coming from four different ips with the first two sets of numbers being different for all four and the last two sets of numbers also being different. e.g. One of the ip addresses with the same first two sets of numbers and the last two sets of numbers being different hit 10 times in one night, which is not much compared to 500.
Yes, the firewall is monitoring incoming and outgoing.
Everyone's suggestions seem to imply there is not much danger, of which you may be right, but since I am not aware of the differences in data signals over the internet I felt it was necessary to consult you. Better to be safe than sorry.
September 16th, 2003, 06:58 AM
I think the main point here of the replies was to test your firewall so you do not respond to the pings.
This discussion has popped up several times in the last few weeks under different names
( Icmp?, Icmp 8 ?, Port 8 (Echo Request), pings & firewalls, etc. ).
I have noticed between 50 -500 each hour for the past several weeks. As others, a very large majority coming from my ISP's range.
My question is, is this the result of a virus, worm, or trojan?
OR, is this the work of some patch ???
" And maddest of all, to see life as it is and not as it should be" --Miguel Cervantes
September 16th, 2003, 03:02 PM
It is the Win32/Nachi worm.
"large volumes of ICMP traffic in network"
We shut off all ICMP traffic on our intranet when this worm was going around.
September 17th, 2003, 01:59 AM
I think that your problem has ended..............but I do have a concern for your personal safety......sorry...............I am being deadly serious here...............I believe that Gore might have received the same message as myself???
Do lock all doors & windows........let people know where you are going... check in regularly. You might even report to your local police that you have been "cyberstalked"...OK I am assuming that you are a female? but even if you are a good looking bloke...........I am worried.
Please take care, whoever you are
I MEAN THAT.............I just got something through the AO system that worries the hell out of me
September 17th, 2003, 02:25 AM
nihil.. what are you smoking ? don'cha think you might be overreacting a bit ?