Unusually High Firewall Activity??? - Tilted Forum Project Discussion Community

MahlerIsGod · 06-05-2006, 10:38 PM

Greetings ALl,
I recently move the switch to ZoneAlarm (yesterday as a matter of fact). I was looking at something else on the interface and just happened to notice what I thought was a very surprising statistic:

http://img1.imagetitan.com/img1/1/20/001709.jpg

In the space of two days, the firewall has stopped over 600 attempts to access my computer. That can't be normal can it? That seems quite high for less than 48 hours. I have Cox cable to a cable modem and that is hooked straight into my computer (via an ethernet cord). Granted, Zonealarm has stopped these attempts (if they are that) so should I be worried? If so, whats the next step? Thanks for any help, suggestions, ideas, etc.

meanSpleen · 06-05-2006, 11:32 PM

They were blocked, thats fine. If you want to dig deeper, try to find out what was being blocked. I don't use Zone Alarm, but there should be a log somewhere of what got blocked. If you find that, post it here

Plaid13 · 06-06-2006, 01:54 AM

thats not too bad really. i used zone alarm for a while and after a few months it had like 40,000 blocked things. 99.99% of the stuff it blocks is totaly harmless and it blocks it just because theres no reason not to block it. Its the two high rated ones you should worry about. but most of the time those are just things that it blocked because you havnt set it up right yet to allow yourself to do something. play a online game send a file to a friend or whatever.

Dilbert1234567 · 06-06-2006, 07:02 AM

If you’re plugged directly into the internet, no router or anything, 600 are very low. The internet is really 'dirty' with tons of infected computers trying to share the love. get your self a router and use that as an additional firewall, its not a true firewall, but it will serve as one, and it will take some of the load off of your system. In addition, software firewalls are vulnerable for a few ms when they are starting, in theory, something could get past after the network card comes online, but before the firewall does.

MechCow · 06-07-2006, 05:55 AM

Quote:

Originally Posted by Dilbert1234567

If you’re plugged directly into the internet, no router or anything, 600 are very low. The internet is really 'dirty' with tons of infected computers trying to share the love. get your self a router and use that as an additional firewall, its not a true firewall, but it will serve as one, and it will take some of the load off of your system. In addition, software firewalls are vulnerable for a few ms when they are starting, in theory, something could get past after the network card comes online, but before the firewall does.

There are many reasons not to use a software firewall. Once a packet has entered your computer there are a number of ways it could exploit or DOS you, either through the network driver (I believe this is becoming more and more common, especially since drivers are taking on more and more features, functionality and stuff that used to be in the hardware), it could exploit your TCP stack or kernel (unlikely but it happens) or it could exploit the firewall application itself. At any rate a software firewall is really just another app competing with other kernel apps and already running malware can find a way around it.

A windows XP computer sitting on the next fresh install is supposed to get 0wn3d within around 1 hour. There are probes going out all the time looking for fresh PCs and I am assuming you are on some kind of cable connection or something? If so you are even more of a target.

Ignore zonealarm its a reasonable product for what it is but I would never run any kind of windows direct on the internet. Pick up a linksys firewall and forget about it (forget about lame inbound probes not security in general, stay paranoid :-)

xepherys · 06-07-2006, 08:55 AM

Well, to throw in my bits, what MechCow said is 100% correct. Software firewalls are often not a good solution at all, and here's why. First, as already mentioned, data has to (literally, actually) physically enter your PC as an electronic signal (packet of data) before your software can stop it. More technically, it has to enter the TCP/IP stack of your network driver, be delivered to software wedged into the kernel somewhere and then be defined as bad or not bad (I won't say good... just not bad). By the time the data is here, it can DoS you (denial of service... cause problems with your connectivity and speed), it can overflow buffers in your driver, in the firewall software or possibly in another process running nearby in memory.

The second downside of software firewalls is that they generally do not behave in a rational way for trying to setup/configure new allowables (this goes for ZoneAlarm and Windows Firewall and McAfee (?) for sure). Sometimes things will mysteriously work or not work when they should not work or work. Also, removing the programs later or even disabling them will not always have the expected effect.

Using a hardware firewall (even a cheap one) will prevent the vast majority of the above listed issues, the only downside being the purchase and configuration of a new piece of network hardware.

Oh, actually, I didn't mean to post only about the firewall, so here's the other stuff:

600 is LOW LOW LOW for 48 hours, even behind a typical firewall. In most standard setups, you'll get ICMP/IGMP packets in a cable subnet that the firewall will block. They're not likely malicious, but your system has no good reason to respond to them. Someone also may have a service sending packets over broadcast or multicast which, in most places get stopped on the cable network, but not everywhere depending on how your local hubs/trunks are setup. High priority alerts are the only thing to generally be worried about.

Plaid13 · 06-13-2006, 07:15 AM

i do agree with getting a router to act as a firewall but dont agree at all with getting a linksys router. i dont know what brand to get but i know i have had 3 linksys in the last few years. the oldest one was great but the last two have been nothing but trouble. i think the company was bought out by someone else and quality control fell through the floor. If you do get a linksys expect to have to reboot it every day or two just to get it to work. Dont be surprised by random lag spikes from it. 90% of the time my connection dies its thanks to that wonderful crappy blue box yay linksys.

Dilbert1234567 · 06-13-2006, 08:34 AM

linksys was bought out by Cisco. They are still great quality, when I did run a linksys, it worked great, I always recommend them and I have never had a problem with them that was not user based. I no longer run a linksys because I built a home brew m0n0wall router.

06-05-2006, 10:38 PM	#1 (permalink)
MahlerIsGod At The Globe Showing Will How Its Done Location: London/Elysium	Unusually High Firewall Activity??? Greetings ALl, I recently move the switch to ZoneAlarm (yesterday as a matter of fact). I was looking at something else on the interface and just happened to notice what I thought was a very surprising statistic: http://img1.imagetitan.com/img1/1/20/001709.jpg In the space of two days, the firewall has stopped over 600 attempts to access my computer. That can't be normal can it? That seems quite high for less than 48 hours. I have Cox cable to a cable modem and that is hooked straight into my computer (via an ethernet cord). Granted, Zonealarm has stopped these attempts (if they are that) so should I be worried? If so, whats the next step? Thanks for any help, suggestions, ideas, etc. __________________ "But a work of art is a conscious human effort that has to do with communication. It is that or its nothing. When an accident is applauded as a work of art, when a cult grows up around the deliciousness of inadvertent beauty, we are in the presence of the greatest decadence the West has known in its history."

06-05-2006, 11:32 PM	#2 (permalink)
meanSpleen Squid hat! Location: A Few Miles Away From Halx	They were blocked, thats fine. If you want to dig deeper, try to find out what was being blocked. I don't use Zone Alarm, but there should be a log somewhere of what got blocked. If you find that, post it here __________________ Like TFP? Donate To Keep It Alive!!

06-06-2006, 07:02 AM	#4 (permalink)
Dilbert1234567 Devils Cabana Boy Location: Central Coast CA	If you’re plugged directly into the internet, no router or anything, 600 are very low. The internet is really 'dirty' with tons of infected computers trying to share the love. get your self a router and use that as an additional firewall, its not a true firewall, but it will serve as one, and it will take some of the load off of your system. In addition, software firewalls are vulnerable for a few ms when they are starting, in theory, something could get past after the network card comes online, but before the firewall does. __________________ Donate Blood! "Love is not finding the perfect person, but learning to see an imperfect person perfectly." -Sam Keen

06-07-2006, 08:55 AM	#6 (permalink)
xepherys <3 TFP Location: 17TLH2445607250	Well, to throw in my bits, what MechCow said is 100% correct. Software firewalls are often not a good solution at all, and here's why. First, as already mentioned, data has to (literally, actually) physically enter your PC as an electronic signal (packet of data) before your software can stop it. More technically, it has to enter the TCP/IP stack of your network driver, be delivered to software wedged into the kernel somewhere and then be defined as bad or not bad (I won't say good... just not bad). By the time the data is here, it can DoS you (denial of service... cause problems with your connectivity and speed), it can overflow buffers in your driver, in the firewall software or possibly in another process running nearby in memory. The second downside of software firewalls is that they generally do not behave in a rational way for trying to setup/configure new allowables (this goes for ZoneAlarm and Windows Firewall and McAfee (?) for sure). Sometimes things will mysteriously work or not work when they should not work or work. Also, removing the programs later or even disabling them will not always have the expected effect. Using a hardware firewall (even a cheap one) will prevent the vast majority of the above listed issues, the only downside being the purchase and configuration of a new piece of network hardware. Oh, actually, I didn't mean to post only about the firewall, so here's the other stuff: 600 is LOW LOW LOW for 48 hours, even behind a typical firewall. In most standard setups, you'll get ICMP/IGMP packets in a cable subnet that the firewall will block. They're not likely malicious, but your system has no good reason to respond to them. Someone also may have a service sending packets over broadcast or multicast which, in most places get stopped on the cable network, but not everywhere depending on how your local hubs/trunks are setup. High priority alerts are the only thing to generally be worried about. Last edited by xepherys; 06-07-2006 at 08:57 AM.. Reason: Automerged Doublepost

06-13-2006, 08:34 AM	#8 (permalink)
Dilbert1234567 Devils Cabana Boy Location: Central Coast CA	linksys was bought out by Cisco. They are still great quality, when I did run a linksys, it worked great, I always recommend them and I have never had a problem with them that was not user based. I no longer run a linksys because I built a home brew m0n0wall router. __________________ Donate Blood! "Love is not finding the perfect person, but learning to see an imperfect person perfectly." -Sam Keen

06-06-2006, 01:54 AM	#3 (permalink)
Plaid13 I want a Plaid crayon	thats not too bad really. i used zone alarm for a while and after a few months it had like 40,000 blocked things. 99.99% of the stuff it blocks is totaly harmless and it blocks it just because theres no reason not to block it. Its the two high rated ones you should worry about. but most of the time those are just things that it blocked because you havnt set it up right yet to allow yourself to do something. play a online game send a file to a friend or whatever.

06-13-2006, 07:15 AM	#7 (permalink)
Plaid13 I want a Plaid crayon	i do agree with getting a router to act as a firewall but dont agree at all with getting a linksys router. i dont know what brand to get but i know i have had 3 linksys in the last few years. the oldest one was great but the last two have been nothing but trouble. i think the company was bought out by someone else and quality control fell through the floor. If you do get a linksys expect to have to reboot it every day or two just to get it to work. Dont be surprised by random lag spikes from it. 90% of the time my connection dies its thanks to that wonderful crappy blue box yay linksys.