firewall question need help please

[video567]

hi i was wondering how can someone track an IP adress? i have a fire wall running and unce in a while i get a security alert saying Default backdoor/Subseven or trojan attemp detected but i dont know how to find out who is knocking at my door.. can someone help me out ? thank you so much

BTW i dont know if this topic fits here or not

[homerpez]

"Discuss 'almost' about whatever you want here. But NO REQUESTS for movies,applications,serials or cracks and NO crap posts please, such posts will be removed."

Yup. It fits.

I'd like to add my question to this thread (since it's an important topic). Does the "Enable Firewall" function under Windows XP's networking do anything reliable at all? Or is it there for comfort? How does it compare?

[d4n13l]

XP's firewall is there as an extra security measure. Believe me, it is a massive jump from the "security" of 9x.
However, as far as firewalls go, it deasnt compare with third party firewalls. You would be better of with a well configured third party firewall if you want to be extra secure.
One more thing, a firewall is only as secure as it is configured to be.

video567,
It can be done but I am afraid i cant tell you because I dont know what software or OS you are running. If its XP I cant be of help because I havent got it installed. Besides what will you do with that IP? It could be spoofed. Unless you know how to fight back, just forget it, or go to some desktop security related sites to learn more. If you are running a firewall, I doubt anybody will spend the time *trying* to hack in anyway. It also requires greater knowledge, something of which 99% of "h4x0r d00dz" are devoid of.
It could actually be a rogue peice of software on your own system that the firewall *sees* as a threat but actually is harmless - It depends how well configured your firewall is. This may be your problem if you regulalry get the same message. Your firewall should provide you with more info than saying that there was a trojan attempt etc. Try looking under its bonnet/hood a bit to find out more about it.

<font size=-1>[ This Message was edited by: d4n13l on 2002-01-06 07:48:21 ]</font>

[dumwaldo]

homerpez...
the windows XP firewall does not monitor outgoing transmissions whatsoever so if a malicious trojan should happen to get onto your system the Win XP firewall will do nothing to stop it or even inform you that it is there. in short no it does not do anything reliable at all besides lull users into a flase sense of security.

video567...
probes are a common thing, wanna be hackers and crackers will use port scanners to go through a wide range of ip addresses looking for vulnerable connections. your best bet is to use a good third part firewall like zone alarm or tiny. both are available as free downloads for non commercial users and both do a very complete job. the best method of firewalling is called stealthing and it makes your computer seem as if it is not even on to a prospective intruder. this is the best way to handle these probes.

some firewalls will will try to retrieve info on your prober but generally speaking all this does is confirm for the attacker that there is a computer located at that IP address. in some cases the firewall can be configured to "attack" an attacker, in theory a good idea but in practice completly unusable. suppose your attacker has the same firewall setup the same way. the result is an endless loop of attacks back and forth between your computer and the attackers that doesn not stop untill one of you shuts down your computer or locks your internet connection.

http://www.grc.com has 2 tests that can check your connection security. one is the Shields UP test that will check how vulnerable you are to someone getting information in and then there is a Leak Test that can check how vulnerable you are to your computer sending information out. the combined results to these 2 tests will speak volumes for how secure your firewall is.

[d4n13l]

"your best bet is to use a good third part firewall like zone alarm or tiny"

Yep, I use tiny if I am using Windows.
Both are very good and will be much more secure than XPs fire-half-wall.

BTW,
dunmwaldo. I actually have configured my 9x so secure that it makes grc scan another computer! LOL! Even if I let it have my real IP it returns nothing. It just shows that security is all about configuring your system yourself and not letting a 3rd party do it.

[bilbogod]

I think that if you put in the ip addresses into the RIPE database (search on Google or upgrade to zonealarm pro) it can sometimes identify the perpetrators. But what you gonna do when it turns out to be MR Xiang Wye Hyan or a multitude of other Asia Pacific Users...

[video567]

thanks im using norton ghost 2002 it seems pretty solid. i guess i should read all the literature... thank you though

[d4n13l]

<TABLE BORDER=0 ALIGN=CENTER WIDTH=85%><TR><TD><font size=-1>Quote:</font><HR size=1 color=black></TD></TR><TR><TD><FONT SIZE=-1><BLOCKQUOTE>
On 2002-01-06 10:00:13, bilbogod wrote:
I think that if you put in the ip addresses into the RIPE database (search on Google or upgrade to zonealarm pro) it can sometimes identify the perpetrators. But what you gonna do when it turns out to be MR Xiang Wye Hyan or a multitude of other Asia Pacific Users...

</BLOCKQUOTE></FONT></TD></TR><TR><TD><HR size=1 color=black></TD></TR></TABLE>
More to the point, how are you going to find out if it spoofed or not.