PDA

View Full Version : Weird conenction request from my AV?


Comp01
October 13th, 2003, 11:30 PM
Okay, my AntiVirus requested this connection (AVG) And its not the update program requesting...

Connection origin
:File Version :******6.0.1.374
File Description :***AvgServ - displays notification message
File Path :******C:\Program Files\Grisoft\AVG6\AVGSERV9.EXE
Process ID :******FFFEA3B1 (Heximal) 4294878129 (Decimal)

***local initiated
Protocol :******ICMP
Local Address : ***(My IP Dont like giving it out, over forums/chats)
ICMP Type :******10 (Router Solicitation)
ICMP Code : ******0
Remote Name :*********
Remote Address :***224.0.0.2

Ethernet packet details:
Ethernet II (Packet Length: 44)
***Destination: ***01-00-5e-00-00-02
***Source: ***44-45-53-54-00-00
Type: IP (0x0800)
Internet Protocol
***Version: 4
***Header Length: 20 bytes
***Flags:
******.0.. = Don't fragment: Not set
******..0. = More fragments: Not set
***Fragment offset:0
***Time to live: 128
***Protocol: 0x1 (ICMP - Internet Control Message Protocol)
***Header checksum: 0xf5fc (Correct)
***Source: (My IP - I dont like giving it out over Forums/chats)
***Destination: 224.0.0.2
Internet Control Message Protocol
***Type: 10 (Router Solicitation)
***Code: 0
***Data (4 bytes)

Binary dump of the packet:
0000: 01 00 5E 00 00 02 44 45 : 53 54 00 00 08 00 45 00 | ..^...DEST....E.
0010: 00 1C 80 3F 00 00 80 01 : FC F5 D1 A5 0C 04 E0 00 | ...?............
0020: 00 02 0A 00 F5 FF 00 00 : 00 00 00 00 | ............

I'm sure its nothing, as I blocked it, but, I jsut wanted to make sure?

CrazyM
October 14th, 2003, 12:16 AM
Hi Comp01

You are right in that it is nothing to worry about.

If you have not done so already, you might want to consider defining some ICMP rules to place in Sygates advanced rules that will be applicable to all applications.

Regards,

CrazyM

BWMerlin
October 14th, 2003, 01:25 AM
What would u suggest.

CrazyM
October 16th, 2003, 08:39 PM
Hi BWMerlin

-{ Quote: " quoting: BWMerlin link=board=23;threadid=14919;start=0#msg93531 date=1066109134]What would u suggest." }-

Basic ICMP rules you could use:

Allow ICMP, Inbound, type 0, 3, 11, Source Any.
Allow ICMP, Outbound, type 8, Destination Any.
Deny ICMP, Inbound/Outbound, All Other.

These rules should suffice for most users.
I will usually allow Outbound type 3 to my ISP's DNS servers as well.

Regards,

CrazyM