Results 1 to 7 of 7

Thread: CONSTANT FWALL ALERTS

  1. #1
    jjimbo Guest

    Default CONSTANT FWALL ALERTS


    i get a medium fwall alert no less than every 10 mins.details are usually...ip source 24.64 etc, source dns s01060003250cd0,whilst defense advisor assures me
    im safe and it was probably
    a background noise i feel that
    for my fwall to be blockin so regularly is concerning or am i paranoid.? Trying to understand
    whois and arin and ripe etc is
    way over my head it might as well be maths equations. one thing i notice is that clicking on the hacker id map the source is always canada or china. but
    it means nothin to me.can anyone shed some light for me please.p.s . since installing the upgrade iin fwall zones i have 1 dhcp server but 2 dns servers showing
    ( ip similair) is this normal?
    i trust zone alarm totally but
    i feel sometimes u need a degree in maths to understand all this
    any help is greatly appreaciated

    Operating System:Windows XP Home Edition
    Software Version:7.0
    Product Name:ZoneAlarm Internet Security Suite

  2. #2
    Join Date
    Dec 2005
    Posts
    8,990

    Default Re: CONSTANT FWALL ALERTS

    Could you list these remote/source IPs' ? It helps us to help you without the info censered.
    You have a dsl internet connection?
    Your assigned IP is static (changes) or dynamic (always remains the same)?
    No router or nat enabled modem?

    Oldsod
    Best regards.
    oldsod

  3. #3
    jjimbo Guest

    Default Re: CONSTANT FWALL ALERTS

    hi old sod thanks for ur reply.most source ip begin 24.64. then 151.136




































































































    228.139



































































































    100.76




































































































    85.144






































































































    41.136






































































































    7.28
    all seem to point to a company called shaw communications in canada.
    i have broadband via modem ,no router. dont know what a nat is but i have very basic set up
    with a modem.

    static or dynamic? aint got a clue wot u mean,im so sorry . i know my ip address has changed since i upgraded zass
    i hope this helps

  4. #4
    Join Date
    Dec 2005
    Posts
    8,990

    Default Re: CONSTANT FWALL ALERTS

    Hi jjimbo

    This is I think happened.

    You just got a new IP assigned by your internet provider. It will change periodically. It keeps changing this means it is "dynamic" as opposed to "static", which means it never will change.

    The previous owner or user of this new IP you just got, did some special networking (P2P, file sharing, special networking, etc) when they had it.
    These previous used connections or previously connecting servers are still trying to connect to the same IP. They have not yet found out it's a new owner and are still attempting to reach the previous user.

    The ZA is blocking these inbound connection attempts. After a while these connection attempts from these servers/PCs will just stop - once they see there is no more replies going back to them. So after a week or so (and maybe for a few weeks) these connection attempts will stop and be gone.

    Some modems for dsl do have a NAT firewall built in. Just having a look at the owners manual or contacting your provider (if renting or bought from the provider) or having a look with google will tell you if there is a NAT firewall built in the modem. Turn it on if there is one. This drop these unwanted connections because of the NAT.

    If there is no NAT in the modem, then look for a cheap router that will handle a dsl modem connection (30-80 dollars). The router will do NAT and also SPI. The router really is fairly simple to setup and use. The router will drop any unwanted inbound connections attempts. This will make things much quieter.

    Okay NAT means network address translation and <a hrf="http://en.wikipedia.org/wiki/Stateful_firewall" target=_blank>SPI</a> means stateful packet inspection.

    Cheers, Oldsod
    Best regards.
    oldsod

  5. #5
    watcher Guest

    Default Re: CONSTANT FWALL ALERTS

    Dear jjimbo:

    You double-posted this thread in the Security Issues category. I responded to that one. Please don't do that in the future. Besides getting in trouble with the Forum-Moderator, you could end up wasting a respondent's time, especially if your question has been answered already. You don't really need to hear the same answer in stereo. In addition, you create additional threads that guests and forum members have to wade through looking for their own answers.

    WATCHER

  6. #6
    jjimbo Guest

    Default Re: CONSTANT FWALL ALERTS

    thank you very much oldsod.
    watcher my sincere apologies.it was unintentional. i thought i posted on wrong forum so i copy and paste to here, but i forgot to go back and delete original. it wont happen again. sorry

  7. #7
    jjimbo Guest

    Default Re: MORE HELP NEEDED PLEASE

    could someone help me further on this topic? i dont know how to
    create expert firewall rules. imgettin worried , my alerts are 1 per minute now, all beggining
    24.64...........

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •