March 4th, 2004, 05:17 AM
My Firewall logs vs. the top 10
Ok, why is it that my logs are not even remotely close to the Top Ten Trends @
the internet storm center? I understand that different regions will have varying
probes, and certain ISP's may or may not be blocking certain ports.But why do I
see all these assorted attacks in the Top Ten, but my logs look the same month
[gloworange]90% - Ports - 1026,1027,1028[/gloworange]
[glowpurple]5% - Ports - 17300, 27374 [Kuang2, Sub][/glowpurple]
5% - ICMP - 8/0
Why can't I be attacked like normal kids?
March 4th, 2004, 10:33 AM
perhaps they are being blocked elsewhere, or perhaps the firewall you are using is not set to log ( or block ) everything.
You said in another post you are behind a SOHO firewall, and use Zone Alarm. Which is this list from ? And are these incoming or outgoing blocks ?
( I’m guessing, but you use ICQ ? )
" And maddest of all, to see life as it is and not as it should be" --Miguel Cervantes
March 4th, 2004, 12:08 PM
Didn't mean to mislead anyone but as far as the internet side I am on AOL [yeah, I know, I know, AOL creates negative air pressure , when I get back to working I'll be back on cable]
Anyway to answer your question, here is my situation - Aol dialup, these are Visual Zone logs from behind ZoleAlarm , firewall set to High, program logging set on high, event logging on ,
event logs = show all alerts. VisualZone is set to include non-attacks, I'm pretty sure I'm in full geek mode as far as the logs. These are incoming blocks and I have never used ICQ.
March 4th, 2004, 09:34 PM
You are a totally unloved person?...............you are not worth "pinging"
Only joking! as you rightly observe, there are regional variations, variations with the ISP/subnet you are on, and so forth.
I think another aspect is that these statistics are not "means" or averages. Where, +9 and -9 give a mean value of zero. You just might not be in the area where these values were generated.? Peaks get to the top of the poll?
Also, I have never reported my stats to the Storm Center?..............bit like an opinion poll held on the highstreet at 3am ?...............only the guys with votes get to make the ratings?
Just a few thoughts?
March 5th, 2004, 12:10 PM
Thanks you two.... all is well then. And nihil, I just called my mother, she wants YOUR IP!
Maybe somebody with some clout around here can start a poll in order to see what AO members are being hit with at home. nihil?
“The magnitude of a threat is inversely proportional to its frequency.” - Courtney