Tilted Forum Project Discussion Community  

Go Back   Tilted Forum Project Discussion Community > Interests > Tilted Technology


 
 
LinkBack Thread Tools
Old 06-05-2006, 10:38 PM   #1 (permalink)
At The Globe Showing Will How Its Done
 
MahlerIsGod's Avatar
 
Location: London/Elysium
Unusually High Firewall Activity???

Greetings ALl,
I recently move the switch to ZoneAlarm (yesterday as a matter of fact). I was looking at something else on the interface and just happened to notice what I thought was a very surprising statistic:

http://img1.imagetitan.com/img1/1/20/001709.jpg

In the space of two days, the firewall has stopped over 600 attempts to access my computer. That can't be normal can it? That seems quite high for less than 48 hours. I have Cox cable to a cable modem and that is hooked straight into my computer (via an ethernet cord). Granted, Zonealarm has stopped these attempts (if they are that) so should I be worried? If so, whats the next step? Thanks for any help, suggestions, ideas, etc.
__________________
"But a work of art is a conscious human effort that has to do with communication. It is that or its nothing. When an accident is applauded as a work of art, when a cult grows up around the deliciousness of inadvertent beauty, we are in the presence of the greatest decadence the West has known in its history."
MahlerIsGod is offline  
Old 06-05-2006, 11:32 PM   #2 (permalink)
Squid hat!
 
meanSpleen's Avatar
 
Location: A Few Miles Away From Halx
They were blocked, thats fine. If you want to dig deeper, try to find out what was being blocked. I don't use Zone Alarm, but there should be a log somewhere of what got blocked. If you find that, post it here
meanSpleen is offline  
Old 06-06-2006, 01:54 AM   #3 (permalink)
I want a Plaid crayon
 
Plaid13's Avatar
 
thats not too bad really. i used zone alarm for a while and after a few months it had like 40,000 blocked things. 99.99% of the stuff it blocks is totaly harmless and it blocks it just because theres no reason not to block it. Its the two high rated ones you should worry about. but most of the time those are just things that it blocked because you havnt set it up right yet to allow yourself to do something. play a online game send a file to a friend or whatever.
Plaid13 is offline  
Old 06-06-2006, 07:02 AM   #4 (permalink)
Devils Cabana Boy
 
Dilbert1234567's Avatar
 
Location: Central Coast CA
If you’re plugged directly into the internet, no router or anything, 600 are very low. The internet is really 'dirty' with tons of infected computers trying to share the love. get your self a router and use that as an additional firewall, its not a true firewall, but it will serve as one, and it will take some of the load off of your system. In addition, software firewalls are vulnerable for a few ms when they are starting, in theory, something could get past after the network card comes online, but before the firewall does.
__________________
Donate Blood!

"Love is not finding the perfect person, but learning to see an imperfect person perfectly." -Sam Keen
Dilbert1234567 is offline  
Old 06-07-2006, 05:55 AM   #5 (permalink)
Upright
 
Location: LSD
Quote:
Originally Posted by Dilbert1234567
If you’re plugged directly into the internet, no router or anything, 600 are very low. The internet is really 'dirty' with tons of infected computers trying to share the love. get your self a router and use that as an additional firewall, its not a true firewall, but it will serve as one, and it will take some of the load off of your system. In addition, software firewalls are vulnerable for a few ms when they are starting, in theory, something could get past after the network card comes online, but before the firewall does.
There are many reasons not to use a software firewall. Once a packet has entered your computer there are a number of ways it could exploit or DOS you, either through the network driver (I believe this is becoming more and more common, especially since drivers are taking on more and more features, functionality and stuff that used to be in the hardware), it could exploit your TCP stack or kernel (unlikely but it happens) or it could exploit the firewall application itself. At any rate a software firewall is really just another app competing with other kernel apps and already running malware can find a way around it.

A windows XP computer sitting on the next fresh install is supposed to get 0wn3d within around 1 hour. There are probes going out all the time looking for fresh PCs and I am assuming you are on some kind of cable connection or something? If so you are even more of a target.

Ignore zonealarm its a reasonable product for what it is but I would never run any kind of windows direct on the internet. Pick up a linksys firewall and forget about it (forget about lame inbound probes not security in general, stay paranoid :-)
MechCow is offline  
Old 06-07-2006, 08:55 AM   #6 (permalink)
<3 TFP
 
xepherys's Avatar
 
Location: 17TLH2445607250
Well, to throw in my bits, what MechCow said is 100% correct. Software firewalls are often not a good solution at all, and here's why. First, as already mentioned, data has to (literally, actually) physically enter your PC as an electronic signal (packet of data) before your software can stop it. More technically, it has to enter the TCP/IP stack of your network driver, be delivered to software wedged into the kernel somewhere and then be defined as bad or not bad (I won't say good... just not bad). By the time the data is here, it can DoS you (denial of service... cause problems with your connectivity and speed), it can overflow buffers in your driver, in the firewall software or possibly in another process running nearby in memory.

The second downside of software firewalls is that they generally do not behave in a rational way for trying to setup/configure new allowables (this goes for ZoneAlarm and Windows Firewall and McAfee (?) for sure). Sometimes things will mysteriously work or not work when they should not work or work. Also, removing the programs later or even disabling them will not always have the expected effect.

Using a hardware firewall (even a cheap one) will prevent the vast majority of the above listed issues, the only downside being the purchase and configuration of a new piece of network hardware.

Oh, actually, I didn't mean to post only about the firewall, so here's the other stuff:

600 is LOW LOW LOW for 48 hours, even behind a typical firewall. In most standard setups, you'll get ICMP/IGMP packets in a cable subnet that the firewall will block. They're not likely malicious, but your system has no good reason to respond to them. Someone also may have a service sending packets over broadcast or multicast which, in most places get stopped on the cable network, but not everywhere depending on how your local hubs/trunks are setup. High priority alerts are the only thing to generally be worried about.

Last edited by xepherys; 06-07-2006 at 08:57 AM.. Reason: Automerged Doublepost
xepherys is offline  
Old 06-13-2006, 07:15 AM   #7 (permalink)
I want a Plaid crayon
 
Plaid13's Avatar
 
i do agree with getting a router to act as a firewall but dont agree at all with getting a linksys router. i dont know what brand to get but i know i have had 3 linksys in the last few years. the oldest one was great but the last two have been nothing but trouble. i think the company was bought out by someone else and quality control fell through the floor. If you do get a linksys expect to have to reboot it every day or two just to get it to work. Dont be surprised by random lag spikes from it. 90% of the time my connection dies its thanks to that wonderful crappy blue box yay linksys.
Plaid13 is offline  
Old 06-13-2006, 08:34 AM   #8 (permalink)
Devils Cabana Boy
 
Dilbert1234567's Avatar
 
Location: Central Coast CA
linksys was bought out by Cisco. They are still great quality, when I did run a linksys, it worked great, I always recommend them and I have never had a problem with them that was not user based. I no longer run a linksys because I built a home brew m0n0wall router.
__________________
Donate Blood!

"Love is not finding the perfect person, but learning to see an imperfect person perfectly." -Sam Keen
Dilbert1234567 is offline  
 

Tags
activity, firewall, high, unusually

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT -8. The time now is 02:57 AM.

Tilted Forum Project

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Search Engine Optimization by vBSEO 3.6.0 PL2
© 2002-2012 Tilted Forum Project

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360