Norton Internet Security Problem! in Security http://www.dslreports.com/forum/r14810645 en Wed, 02 Dec 2009 10:42:06 EDT Wed, 02 Dec 2009 10:42:06 EDT Re: Norton Internet Security Problem! http://www.dslreports.com/forum/remark,14826128 Red Dragon : I also just remembered something about NIS. This should not be occurring every minute or so. Under default setting NIS will auto block IPs that make an intrusion attempt. Unless auto block is disabled or set to a bizarre low ban time then this should not be occurring. Also 255.255.255 and IPs like then remind me of subnet masks. kind of makes sense since it is pointing back to your own computer as the attacker. You could also try windows repair function for you net connection to see if that helps.
--
That light that you see at the end of the tunnel. You know that reealy bright one; well its not salvation. Its the 6 o'clock freight train]]> http://www.dslreports.com/forum/remark,14826128 Thu, 17 Nov 2005 13:04:57 EDT Re: Norton Internet Security Problem! http://www.dslreports.com/forum/remark,14825183 B :
I'm afraid you're going to have to either hire someone or find a friendly neighborhood geek to help you. It's just about impossible to properly train you quickly via a web forum. It's really up to you to read and research (and experiment!) until you understand.

But really, I'm not sure you have a problem worth putting all that time into.

What I mean is, a strange packet every minute is not a big deal; again I suggest you get a router. My suspicion is simply that your firewall is screwy; you could uninstall / reinstall NIS and/or try a different firewall product.

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,14825183 Thu, 17 Nov 2005 11:00:29 EDT Re: Norton Internet Security Problem! http://www.dslreports.com/forum/remark,14825163 jellybeans27 : I can't understand the help section of ethereal, I don't know how to use it can someone help me please? Thanks.]]> http://www.dslreports.com/forum/remark,14825163 Thu, 17 Nov 2005 10:57:24 EDT Re: Norton Internet Security Problem! http://www.dslreports.com/forum/remark,14824966 B : For more than you could want to know, check the Router section of the FAQ at »Security

In brief, the original poster appears to have a public IP address. A layer of NAT routing between him or her and the Internet is a valuable (and one might argue essential) safety measure. (With a private IP address, unsolicited inbound packets get no further than your router.)

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,14824966 Thu, 17 Nov 2005 10:24:22 EDT Re: Norton Internet Security Problem! http://www.dslreports.com/forum/remark,14824197 Red Dragon :
said by SamN :

what will buying a router do?
? It would stop that mess from appearing on his computer. The packets would be blocked at the router. Ever hear of NAT?
--
That light that you see at the end of the tunnel. You know that reealy bright one; well its not salvation. Its the 6 o'clock freight train]]> http://www.dslreports.com/forum/remark,14824197 Thu, 17 Nov 2005 07:39:58 EDT Re: Norton Internet Security Problem! http://www.dslreports.com/forum/remark,14824075 anon : what will buying a router do?]]> http://www.dslreports.com/forum/remark,14824075 Thu, 17 Nov 2005 06:49:26 EDT Re: Norton Internet Security Problem! http://www.dslreports.com/forum/remark,14820745 jvmorris : All ethereal is going to do is give you a capability to capture the packets; you still have to enable it and I believe what that involves is described (in excuciating detail) in the accompanying documentation.

Mind, I've never done this myself, so yes I'm talking off the top of me head. :)
--
Regards, Joseph V. Morris]]> http://www.dslreports.com/forum/remark,14820745 Wed, 16 Nov 2005 18:18:02 EDT Re: Norton Internet Security Problem! http://www.dslreports.com/forum/remark,14820617 jellybeans27 : Thank you. I have downloaded 'ethereal' and i have installed it.....what do i do now to 'track' the packet(s)? Thanks so much for help]]> http://www.dslreports.com/forum/remark,14820617 Wed, 16 Nov 2005 18:03:06 EDT Re: Norton Internet Security Problem! http://www.dslreports.com/forum/remark,14819184 ranschultz : Ethereal is a popular open source packet sniffer for Windows. The ethernet address (aka MAC or NIC address) will appear in every packet that it tracks. A user's guide is available to give you guidance on using it.]]> http://www.dslreports.com/forum/remark,14819184 Wed, 16 Nov 2005 14:54:10 EDT Re: Norton Internet Security Problem! http://www.dslreports.com/forum/remark,14817981 jellybeans27 : Also, how do I use a packet sniffer? How do I get the 'ethernet address'?]]> http://www.dslreports.com/forum/remark,14817981 Wed, 16 Nov 2005 12:18:00 EDT Re: Norton Internet Security Problem! http://www.dslreports.com/forum/remark,14816138 jellybeans27 : Which 'packet sniffer' do you recommend?]]> http://www.dslreports.com/forum/remark,14816138 Wed, 16 Nov 2005 06:36:55 EDT Re: Norton Internet Security Problem! http://www.dslreports.com/forum/remark,14813629 ranschultz : This appears to be a smurf type of attack. Somebody on your local segment is sending this packet with the intent of using your machine to amplify the attack and cause a denial of service to your segment or some machine on your segment.

To figure out who it is you'd have to use a packet sniffer to get the ethernet address associated with the offending packet and associate that with an Internet address. Reporting the ethernet address alone to your ISP should be sufficient to track this person down.

Edit: fixed a bone-headed wording mistake.]]> http://www.dslreports.com/forum/remark,14813629 Tue, 15 Nov 2005 20:34:47 EDT Re: Norton Internet Security Problem! http://www.dslreports.com/forum/remark,14811932 jvmorris : Looks like it's coming from NIS' IDS subsystem, rather than the firewall. Pity it doesn't give more details about the ICMP message involved.

Maybe Reese can shed some light on this.
--
Regards, Joseph V. Morris]]> http://www.dslreports.com/forum/remark,14811932 Tue, 15 Nov 2005 16:54:34 EDT Re: Norton Internet Security Problem! http://www.dslreports.com/forum/remark,14811891 jellybeans27 : Here's an example from my activity log:

Details: Intrusion: Invalid Source IP Address.
Intruder: 255.255.255.255.
Risk Level: Medium.
Source IP address: 255.255.255.255.This IP address is invalid.
Destination IP address: YOUR-JSAHFDNCU3(84.13.89.247).
Protocol: ICMP.
]]> http://www.dslreports.com/forum/remark,14811891 Tue, 15 Nov 2005 16:50:00 EDT Re: Norton Internet Security Problem! http://www.dslreports.com/forum/remark,14811024 jvmorris : Okay, found the earlier thread. It's at »NIS2006 .

Did it look like this? (Probably not, I see that's an outbound attempt and it sounds like you're talking a inbound attempt.)
--
Regards, Joseph V. Morris]]> http://www.dslreports.com/forum/remark,14811024 Tue, 15 Nov 2005 14:51:52 EDT Re: Norton Internet Security Problem! http://www.dslreports.com/forum/remark,14810732 ranschultz : As Mr. Morris suggests, a detailed log entry would be appreciated. Short of, or, in addition to that, can you provide the full text of the show details? It would be helpful to know what kind of intrusion is being attempted.]]> http://www.dslreports.com/forum/remark,14810732 Tue, 15 Nov 2005 14:12:38 EDT Re: Norton Internet Security Problem! http://www.dslreports.com/forum/remark,14810689 B :
Reboot.

And get I suggest you get a router.

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,14810689 Tue, 15 Nov 2005 14:06:02 EDT Re: Norton Internet Security Problem! http://www.dslreports.com/forum/remark,14810658 jvmorris : Can you copy and paste the whole message from the NIS firewall event log?

It sort of sounds like something that someone else saw a few days back.
--
Regards, Joseph V. Morris]]> http://www.dslreports.com/forum/remark,14810658 Tue, 15 Nov 2005 14:02:38 EDT Norton Internet Security Problem! http://www.dslreports.com/forum/remark,14810645 jellybeans27 : my problem is that literally every minute i get a pop-up in the bottom right hand corner of my screen saying 'an intrusion attempt has been blocked.' So i click it to find out more and i click 'show details' and it says the intruder is 255.255.255.255 and under source IP address it says '255.255.255.255.This IP address is invalid.' It also says that the destination IP address is 'YOUR-JSAHFDNCU3(84.13.89.247).' Which is me (my computer name and IP address at that time). What is causing this to happen EVERY SINGLE MINUTE? Please help, Thank you.]]> http://www.dslreports.com/forum/remark,14810645 Tue, 15 Nov 2005 14:00:46 EDT