Firewall Blocking Traffic from 255.255.255.255?

Printable View

August 24th, 2003, 04:32 AM
kja

Firewall Blocking Traffic from 255.255.255.255?

Hi,

I'm new here, and I don't really understand alot about firewall activity, so I was hoping someone might be able to help me with this. I keep getting bombarded with the following message:

McAfee Firewall automatically blocked incoming traffic from IP address 255.255.255.255. You have configured McAfee Firewall to always block traffic to or from this address. The IP protocol type was 17 [UDP]. The remote address associated with the traffic was 10.40.224.1. The network adapter for the traffic was "Intel(R) PRO/100 VE Network Connection".

I'm not sure how long my firewall has been blocking the attempts, but I just got cable two weeks ago, and I've been checking the activity logs alot more since then. I'm starting to get pretty worried, because today alone, there have been 422 entries like that in the last 8 1/2 hours. Also, I never configured my firewall to block traffic from that address, although the message says I did.

Could somebody tell me what's happening, and if there's anything I can do to stop it? I'd really appreciate any info you can provide!
August 24th, 2003, 04:58 AM
gunit0072003

Protocol 17 is udp and I believe protocol 6 is TCP
the dst address is 255.255.255.255 (broadcast)
Now the only thing that you do not know is
what application using UDP was hitting your PC..

I would make an educated guess and say especially
in windows environment that these packets are netbios UDP
broadcast packets that windows every so often sends out..
Depending on flavor of windows, it might just be a PC advertising
its computer name,as what windows OS's do..

To be on the safe side, install a protocol analyzer,,gosh there are so many
out there,,,search the threads on popular ones/download sites..
I would recommend Ethereal, however I do not want to start a holy war
Im sure there are alot other ones just as good if not better,,lol
http://www.ethereal.com/

Cheers..
August 24th, 2003, 05:09 AM
cheyenne1212

Are you on a network, because what it sounds like is a broadcast like gunit was saying.

I get thoughs some times on my network but its from my router, or another PC on my lan.
August 24th, 2003, 05:11 AM
gunit0072003

Your right cheyenne, it might also be dhcp broadcast packets if router
was set up as dhcp server..DHCP also uses UDP...
August 24th, 2003, 05:16 AM
cheyenne1212

Yeah thats what I was thinking because the IP he gave us 10.40.224.1 sounds like a private address assigned to netwoks.
August 24th, 2003, 05:20 AM
gunit0072003

Also cheyenne

If he was using cable modem. which is a bridge/same broadcast domain
and the fact that w/cable modems you are on same broadcast domain as a whole bunch of other users in your neighborhood, it is also possible to see the netbios/UDP broadcasts,,,

That's one flaw or disadvantage w/cable modems,,,,
shared bandwidth as well as shared broadcast domain,....

Dont get me wrong I luv mines...lol
August 26th, 2003, 11:15 PM
kja

Thanks for all the information gunit0072003 and cheyenne1212. I only wish I understood half of it. I’m embarrassed to say that this kind of technical stuff goes right over my head. I went to ethereal.com and didn’t understand the introduction, so I figured I better not mess with it. Is there any way you can suggest what I should do in layman’s terms, for someone who has a hard time grasping all this? Thanks again!

karin
August 26th, 2003, 11:36 PM
souleman

kja> don't worry about it. You don't need the packets so just let the firewall block them. Thats about as good as you can get in laymens terms :D
August 26th, 2003, 11:46 PM
Swampy_ finger

Lets just sum this thread up that firewall might be complicated for you since you said this technical stuff goes right over your head my advice is to take these simple newbie steps ........ Go to this link to get all of these free or trial softwares i use ......http://download.com.com/2001-20-0.html and type in the search bar for these following softwares 1.OUTPOSTl2.SPYBOT 3.regcleaner this is probably a tracking cookie from a dirty site you picked up on running as ROOT or aka adminastrator these softwares are justa couple of easy steps to keeping your box cleaner than it was
August 27th, 2003, 12:02 AM
slarty

There is no need to block packets with a broadcast source or destination. They won't be routed over the internet anyway.

Packets with a network broadcast destination should however be blocked at the router to prevent your network being used as a smurf amplifier.
August 27th, 2003, 01:38 AM
Swampy_ finger

To help the newbies with there firewalls configure configure configure

1.step click start menu
2.click run
3.type in services.msc
4.hit enter it should bring you to a service window
now this is simple start at the top of the list go
down and find the following items and right click then properties
and disable the
following items on the my list ok simple
THE LIST:
1.DSN Cient
2.Error reporting services
3.Help and support
4.IPSEC services
5.messenger
6.NVIDIA Driver helper
7.System restore
8.Task scheduler
9.TCP/IP NetBIOS helper
10.network location awareness
11.SS DP discovery services
August 27th, 2003, 01:56 AM
phishphreek

Swampy_ finger:

I'm very curious as to why you recommend disabling the System restore service?

When I was first starting out learning all about computers there was no system restore... and I wish there had been. My system restore was getting out the install disks and my backups...

I think the system restore service is great for the following reasons...

If you are installing software that you don't know will work well with your PC or drivers that may cause your system to become unstable, you can simply rollback. It is much easier to do that, than it is to boot to safe mode, remove offending programs/drivers, load correct drivers, etc.

Granted... it my take up a bit of HD space and a bit of resources... and if you are infected with a virus or trojan... it makes it a bit harder to clean up... but simply stopping that service will dump your restore data.

I also normally disable the webclient, wireless client, computer browser, portable serial number, remote registry, routing and remote access, UPnP, time, automatic updates (cause I like to update my own) and the alerter service.
August 27th, 2003, 02:00 AM
FrameWork

Quote:

I think the system restore service is great for the following reasons...

That is when it works properly. :p

__

I agree though, newbies will almost certainly find a friend in System Restore. Personally, I disable System Restore only because I never use it.

Just my 2 cents...
August 27th, 2003, 02:02 AM
phishphreek

Quote:

That is when it works properly.

I've never run into any problem with it *knocks on wood*. But then again... I don't just go installing just anything anymore. I've learned enough times not to do that... :rolleyes:

What kinds of problems have you experienced?
August 27th, 2003, 02:16 AM
Swampy_ finger

nobody knows how much microsoft can screw you over especially with its new features such as system restore it seems like everyday microsoft has somthing else gay around the corner like that guy kicking down the door in the humor forums lol I guess you should only tweak things that your sure you dont need
August 27th, 2003, 02:24 AM
FrameWork

Quote:

I've never run into any problem with it *knocks on wood*. But then again... I don't just go installing just anything anymore. I've learned enough times not to do that...

What kinds of problems have you experienced?

Well i used to install just about anything i could get my hands on. The average careless windows user that i was only 2 years ago. :p

It worked out fine for me on numerous occasions, but sometimes when i went tweaking around in the registry and happend to screw something up it would'nt correct what i messed up after performing a System Restore. Obviously i have no one to blame for that but myself, but still. I just think it does'nt always come through for you, so i would'nt bet the farm on it or anything. However, like you said, it's great for some people; especially newbies.

I've just learned how to be more careful; so i don't have a huge need for it anymore. It's probably a good idea to have it running even if you want to have as few services running at any one time, but i disable it first thing after a fresh install.

~FrWk
August 27th, 2003, 02:37 AM
kja

Thanks to all of you who posted information. I really appreciate it! I didn’t mention in my first post that the all log entries also said something like this at the bottom of the message (each one differs just a little):

The binary data contained in the packet was "ff ff ff ff ff ff 00 08 e2 32 10 54 08 00 45 00 01 50 30 57 00 00 ff 11 a0 1c 0a 28 e0 01 ff ff ff ff 00 43 00 44 01 3c 68 7a 02 01 06 00 0d 9a ed 20 00 00 80 00 00 00 00 00 18 18 cd 04 00 00 ".

Does that tell you if the packets have a broadcast source or destination? Also, I checked my firewall again, and although the activity and warning logs have tons of entries for 255.255.255.255 today, the current activity log lists only one for that IP. It says:

Program: SVCHOST.EXE
Local Port: 1028 [ephemeral]
Remote Address: 255.255.255.255
Remote Port: 0
Start Time: 08/26/03 11:47:28 AM
Duration: 19884
Sent (bytes): 0
Received (bytes): 0

Is any of this information helpful in telling you more about what’s going on? If you say it’s nothing for me to be worried about, then I’ll just ignore the messages from now on. At least I’ll have the peace of mind that all those particular messages aren’t hacking attempts.

I regularly run SpyBot and Ad-aware, and whenever they find spyware, I get rid of it. Out of curiosity, what will disabling the items listed above do?

Thanks,
Karin
August 27th, 2003, 02:43 AM
FrameWork

Quote:

I regularly run SpyBot and Ad-aware, and whenever they find spyware, I get rid of it. Out of curiosity, what will disabling the items listed above do?

Look's like a good practice to me. :)

Only disable the items in that list after you go here--> www.blackviper.com Not all people will want to disable all of those services. Disabling services can speed up your performance aswell as shut down vulnerable ports on your machine. I disable services primarly for the two reasons i mentioned here.

~FrWk
August 27th, 2003, 02:46 AM
kja

Thanks FrameWork! I'll take a look at that site.

Karin
August 27th, 2003, 02:48 AM
FrameWork

I'm having trouble accessing the site at the moment. It may be down temorarily. It's a great site that list the details of what each service does and how safe it is to disable them. It's worth a bookmark for sure.

Have fun. :)
August 27th, 2003, 03:29 AM
phishphreek

I have blackvipers xp services guide/info posted on this site in a pdf format. It is only for XP though. I never uploaded the 2k pdf and I don't have that at hand...

Try this link.

Or, visit my profile , and look for the file called xpservices.zip in the "Most Downloaded Files Attached By User" section of the profile in the bottom left corner.

Oh, BTW: The verson I have is was last updated Oct2k2, so when the site comes back up, it may be worth it to see if he has updated his info/files.
August 28th, 2003, 05:45 AM
Swampy_ finger

Is this what we are talking about
LINK:
http://assets.smoothwall.org/images/...irewalllog.png

just a suggestion