RE: intrusion detected

["R. DuFresne" <dufresne () sysinfo com>]

> You might try http://search.symantec.com for answers.
>
> This document seems to be relevant:
> http://service1.symantec.com/SUPPORT/nip.nsf/pfdocs/2002093014331836

This does not seem to be the issue he tried to document, as his issue
pointed to 0.0.0.0/0 which tends to be the servers own assignment, rather
then his ISP's.  

 Source IP address: xx.xx.xxx.x
   Destination IP address: 224.0.0.1
   Protocol: IGMP.

MULTICAST/braodcast stuffs that might be related to his issue, but, I got
the impression it was not.

Though, his information was limited here.  He should not only be getting
an alert stating the IP of the intruder, but the protocol or application
causing the alert, especially on protocols/applications trying to connect
out from his system to the world.   Alberto, which application<s>
constantly send you this alert?

have you tried making a localhost rule in your advanced properties for the
application/protocol in question?  Be carefull here, you could well be
opening a trojan's port.

Thanks,

Ron DuFresne



> -----Original Message-----
> From: Alberto Valero "Gómez [mailto:avalero () alum etsii upm es] 
> Sent: Tuesday, December 03, 2002 10:04 AM
> To: firewall-wizards () honor icsalabs com
> Subject: [fw-wiz] INTRUSION DETECTED
>
>
> Hello, i use winXp Service Pack 1 and use Norton Personal Firewall 2003. I
> have the followin problem that hope some of you can solve me.
>
> The firewall keeps on advising me that it has detected an intrusion. It says
> that the intruder is my own IP and that it's trying to access an invalid IP
> that is always like 0.0.x.x.
>
> I have a dynamic IP so it changes every time i connect to the net and my
> computer is not in a subnet but directly connected to the the net via a
> CableModem.
>
> Would anybody help me?
>
> Thanx. Alberto.
>
> _______________________________________________
> firewall-wizards mailing list firewall-wizards () honor icsalabs com
> http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards () honor icsalabs com
> http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!


_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards