Results 1 to 8 of 8

Thread: Thousands of connections in one hour blocked???

  1. #1
    klikerko Guest

    Default Thousands of connections in one hour blocked???

    Hi people,

    I have very very odd problem. This is my story.

    In last two weeks I'm experiencing extremely slow Internet connection. For example just to open this page to post message I waited almost a minute. Internet became so slow that just opening a Google or some other small website is painful. I never had a problem like this and I have **bleep** and SpyBot always active and updated.

    Since I didn't found where is a problem, hour ago I decided to install ZoneAlarm 7.0.462. I was amazed when he reported more that 5000 blocked incoming connections in "Inbound protection" in just one hour?! While I'm typing this message I'm looking at counter and there is almost one blocked connection every second, now is at 6000. I checked addresses and almost all are from Asia. Now I realize that my internet was slow because of these incoming connections. I scanned computer with **bleep**, SpyBot, HijackThis and Ad-avere. They didn't found any problem now but a month ago I found few problems with SpyBot and they were deleted.

    My question is, what is going on here??? I'm not computer rookie and I understand how things are working but I don't understand now is possible that my computer is receiving thousands of connections from various addresses in just one hour? What caused this problem? How I can solve this?

    PS: I don't have a static IP.

    Thank you in advance,
    Klikerko

    Operating System:Windows XP Pro
    Software Version:7.0
    Product Name:ZoneAlarm (Free)

  2. #2
    Join Date
    Dec 2005
    Posts
    9,008

    Default Re: Thousands of connections in one hour blocked???

    Using dialup or no hardware firewall in front?

    Are the TCP Flags for the dropped inbound connection labled S or A?

    Oldsod
    Best regards.
    oldsod

  3. #3
    klikerko Guest

    Default Re: Thousands of connections in one hour blocked???

    Hi & thank you for your reply...

    This is current situation. Until now I had more then 11000 inbound connections blocked and that's for last 5-6 hours only. I checked last 300 connections and they are all from different IPs, rated Medium, and they are all targeting my computer at 192.168.0.2 and only at ports 1573, 2038 and 50401. Last port is used by my torrent client but I didn't start that program probably for one week. Is it possible that this is the reason? If it is I don't understand how it's possible since I don't have static IP, how they are still targeting my computer?

    I have ADSL modem and Linksys voice modem/router. ADSL is going through Linksys. I didn't configure nothing special, just connected them following instructions. I have no port forwarding. I had closed all resident software and left only antivirus and ZA but still my Internet access is stormed by those connections.

    Sorry, I didn't understood what you mean by S or A flags?

    Thanks,
    Klikerko

  4. #4
    Join Date
    Dec 2005
    Posts
    9,008

    Default Re: Thousands of connections in one hour blocked???

    <blockquote><hr>Klikerko wrote:
    Hi & thank you for your reply...

    This is current situation. Until now I had more then 11000 inbound connections blocked and that's for last 5-6 hours only. I checked last 300 connections and they are all from different IPs, rated Medium, and they are all targeting my computer at 192.168.0.2 and only at ports 1573, 2038 and 50401. Last port is used by my torrent client but I didn't start that program probably for one week. Is it possible that this is the reason? If it is I don't understand how it's possible since I don't have static IP, how they are still targeting my computer?

    I have ADSL modem and Linksys voice modem/router. ADSL is going through Linksys. I didn't configure nothing special, just connected them following instructions. I have no port forwarding. I had closed all resident software and left only antivirus and ZA but still my Internet access is stormed by those connections.

    Sorry, I didn't understood what you mean by S or A flags?

    Thanks,
    Klikerko
    <hr></blockquote>


    Ok you have a modem router with NAT and still get intrusions?
    You use a torrent and have no ports forwarded?

    Seems as though if they can get past the router to the PC, then the ports are still left open in the router and they are coming through. Maybe if the torrent is closed, then close the ports in the router too.

    Plus I suppose the modem or the modem router is set to reply to pings - they are pinging the internet and probably your modem/router is responding. Besides the fact that the torrent probably needs the reply to pings.

    Plus other nodes of the torrent client (the other PCs/servers) will always attempt keep connected to your PC weeks after your torrent has been closed.


    Oldsod

    Message Edited by Oldsod on 02-19-2008 04:09 AM
    Best regards.
    oldsod

  5. #5
    klikerko Guest

    Default Re: Thousands of connections in one hour blocked???

    Hi again,

    I done some testing last few days. I compared IP addresses from Zone Alarm log with addresses from my Torrent client and all blocked inbound intrusions are related to Torrent downloads. When I turned of my router and modem and power them on again I got new IP. All intrusions stopped immediately and I didn't have any for hours. Then I started again my Torrent client and left him downloading just one file for a few hours just for a test. Then I closed torrent client and now, almost 24 hours after I stopped downloading with Torrent I'm getting huge number of blocked inbound intrusions. Then, when I turned on and off my modem and router again it's quiet again.

    So, all this is related to Torrent. Bad thing is that this has huge impact on my Internet speed after download is finished.

    Thanks again,
    Klikerko

  6. #6
    Join Date
    Dec 2005
    Posts
    9,008

    Default Re: Thousands of connections in one hour blocked???

    Using Peer Guardian?
    Unfortunately, there is no way to inform the other nodes of the torrent to stop trying to connect and cease. They will continue to attempt to connect weeks after you have stopped using the torrents.

    Oldsod.
    Best regards.
    oldsod

  7. #7
    klikerko Guest

    Default Re: Thousands of connections in one hour blocked???

    No, I'm not using Peer Guardian. I will check it now, should I use it even if I have Zone Alarm?

    The fact that they will try to connect on my IP weeks after I disconnect from torrent downloading is amazing! I had never thought about that... I'm just trying to image now much trash traffic we have on Internet!? Now I'm glad that I have dynamic IP.

    Klikerko

  8. #8
    Join Date
    Dec 2005
    Posts
    9,008

    Default Re: Thousands of connections in one hour blocked???

    Peer Guardian is a dedicated IP blocker and several block lists are premade and readily useable. Just take a look and you will probably decide to try it.
    I use the Protowall, and do not do any P2P - just using it to block out spyware/troyans/ads and unwanted IPs.
    Yes I suppose if you have the IP changed the connections attempts will be gone till you hook up again. But the next person to get assigned your old IP will be stuck with all of your torrrent connection attempts. Hope they have a router

    Cheers, Oldsod.
    Best regards.
    oldsod

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •