Zone Alarm

[beavereater]

Every so often I get this message...I never really know what to do. BUT this one seems to come from someone on the same ISP, if that makes any sense. Anyone else use ZA!!

[BodaZoffa]

If zone alarm works anything like NIS, then it looks like someone pinged your PC to see if there was an open port. This happens quite frequently. I would click the "don't show me this again" box, & hit OK.

[beavereater]

THanks...but what about when the same person keeps pinging me!?

[redwudz]

When I first got my cable modem I got 10 to 15 of those a day. I used a software firewall similar to zone alarm. Alerts all the time. You can use a program like the freeware Neo Trace express to easily find out who they are and where they are. Most of mine were innocent and were browser bots just looking for new links. A few had .ru addresses and were looking for easy victims. As long as they are being blocked, no worries. If you are using cable, then a router/switch is a must to keep them out.

Edit: If a particular party keeps trying to hit on your machine, bring this to the attention of the ISP manager. The port used, 4815 is unassigned. Port numbers here:http://www.iana.org/assignments/port-numbers

[d_unbeliever]

jaz click the Don't show this dialog again...and don't worry about it

this means that your zone alarm is working and is blocking those type of connection...

[devinemi83]

THanks...but what about when the same person keeps pinging me!?

Can be a few things.


Just for some reason you keep getting pinged.
He/she knows your IP and for some reason is trying to access you.
Or its a total mystery LOL

I had this happen last week. One IP from the US kept pinging my computer uses HUNDREDS of different ports. He was clearly trying to feel around to find open ports. Some of these were known virus ports. Maybe seeing if I was infected and then if he could control one?
Then a few months ago dear sweet comcast screwed up the local config on our cable modem networks and they marked me as a DNS server for this area. Man.....I was getting HAMMERED! All these damn DNS pings.


As long as it says zonealarm is stopping them, no worries. Those people cant get to you even if they do have a bad intention. But 99% of what ZA labels "attacks" are simply harmless pings.

[808smokey]

I get those all the time, it's alway my ISP pinging my computer/modem to make sure it's still there.

[Ripper2860]

Sometimes people's PC's are unknowing participants in these types of activities due to trojans that have been installed on their computers. The person owning the PC may not even be aware that their PC has been compromised and is scanning other PC's to find open ports.

A report to your ISP may bring about further analysis and if the user is unaware, many times the ISP will notify the user and assist them in removing any "suspect" programs.

[northcat_8]

I have gotten those. That is just telling you that it blocked "hacker like" activity...such as a port scanner or pinger. ZA blocks it anyway. If I am not mistaken...and I may very well be...but I think that is mainly protection for ports not typically used.

Like someone else said, if you just check the little check box ZA will still block them, it just won't tell you about it all the time.

[devinemi83]

I have gotten those. That is just telling you that it blocked "hacker like" activity...such as a port scanner or pinger. ZA blocks it anyway. If I am not mistaken...and I may very well be...but I think that is mainly protection for ports not typically used.

Like someone else said, if you just check the little check box ZA will still block them, it just won't tell you about it all the time.

It blocks all unrequested traffic. I have it alot when I turn off BT or kazaa, it will get a sudden list of things trying to connect to them, but it knows as soon as the software is shut off that no one from the outside is allowed in anymore. Zonealarm can even give a heads up for massive virus attacks. Like when a few months or maybe a year ago that big SQL Slammer went around that night before it hit the media saw a HUGE spike in access attempts on 1433 and 1434. I mean like 1-2 a second. And I have never run ANY public server let alone a SQL database. I knew what was going on before 90% of america did. Most anyone who had a firewall knew it too.

[beavereater]

I guess I just have to learn a little more about firewalls and ZA. Its just when I get something poping up in RED saying something to the effect of being attacked, kind gets to me. I would love to be able to trace that IP address somehow. I've heard of people doing it but know nothing about it, any free tools out there that can do this, providing as much info as possible.

[d_unbeliever]

i get worried too when others do this to me...and sometimes i wish i could also screw up their system dont have the time though ... try searching the words TRACE ROUTE in Google...

[redwudz]

Try NeoTrace Express, it's freeware and also entertaining as it maps the route back to IP address you input. It will run with IE.

The pro version is very impressive, similar to what law enforcement uses to trace hackers. It will show you where your signal goes through each router to the source, showing the time each step takes. Good for checking where the slowdown is. It can also show you the name of the originating ISP if you want to complain about one of their users.

http://www.networkingfiles.com/PingFinger/Neotraceexpress.htm