Something I've wanted to know, but have been too afraid to ask...until now

[HandsOff]

I have noticed that my firewall (Norton) includes a visual tracker and can tell you the address and the domain of the dozens of people who attack my little home computer every day.

I have known for some time that one can report "abuses" to a representative of the domain that includes the address that has launched an attack on you.

I am pretty sure that there are two unwritten rules:

1) Do not bother blocking individuals because there are too many to block
2) Do not compaint the Abuse@blahblahblah because you are only asking for trouble if you do.

At this point i may as well state that I no longer have enough money to buy the prescriptions that keep me relatively rational.
Recently I began laboriously blocking every single solitary address that attacked my computer (hundreds, thousands). I am aware of the downside of blocking so many addresses, however this was sort of an experiment...in short, rule number one broken. Today I finally sent off a letter to abuse@aol.net, not necessarily because they are worse than the rest, just happened to the most recent attackers. I included the details of two recent attacks from there domain, as well as a great deal of editorializing on my part.

I guess i should include at least the two examples (i'll spare you the rant)

12/30/2003 @ 9:50:22 pm
Details: Rule "Default Block Backdoor/SubSeven Trojan horse" blocked (172.158.16.104,27374)
Inbound TCP connection
Local address,service is (xxxxxxxxxxxxxxxxxxxxxxxxxxxx)
Remote address,service is (172.158.16.104,3957)
Process name is "N/A"

12/30/2003 @ 9:54:54 pm
Details: Rule "Default Block Backdoor/SubSeven Trojan horse" blocked (172.202.127.84,27374)
Inbound TCP connection
Local address,service is (xxxxxxxxxxxxxxxxxxxxxxxxxxx)
Remote address,service is (172.202.127.84,3159)
Process name is "N/A"

I wrote because i was annoyed but also, i want to know, and i don't seem to be getting it on my own.
-Are the so called attacks Norton reports really attacks?
-Do ISP's care, will they investigate complaints?
-Should I turn off my computer for several months until the people i have offended by complaining forget about me?

It is too soon to see if AOL responds, but my hope of getting a useful answer is not very high. Anyone care to comment?

-HandsOff

[CrazyM]

Hi HandsOff

{QUOTE-> quoting: HandsOff link=board=23;threadid=18632;start=0#msg114735 date=1072853157]Recently I began laboriously blocking every single solitary address that attacked my computer (hundreds, thousands). I am aware of the downside of blocking so many addresses, however this was sort of an experiment... <-QUOTE}

No real need to do that, the firewall was already blocking them and will continue to do so. The firewall, if properly configured, will block all unsolicited packets.

{QUOTE-> I wrote because i was annoyed but also, i want to know, and i don't seem to be getting it on my own.
-Are the so called attacks Norton reports really attacks? <-QUOTE}

No, just any number of things that routinely show up in firewall logs as a result of the recent worms, compromised systems and people scanning for compromised systems.

{QUOTE-> -Do ISP's care, will they investigate complaints? <-QUOTE}

There is not much point in dealing with ISP's on an individual basis for routine and harmless scans. If you want to do something about these events, you are better off getting involved with something like DShield (http://www.dshield.org) or myNetWatchman (http://www.mynetwatchman.com/default.asp) where they collect and summarize logs from all contributors and send notices to the appropriate ISP's.

{QUOTE-> -Should I turn off my computer for several months until the people i have offended by complaining forget about me? <-QUOTE}

No, let your firewall do what it is supposed to, don't worry about the logs and go about surfing and enjoy your time on the Internet.

{QUOTE-> It is too soon to see if AOL responds, but my hope of getting a useful answer is not very high. Anyone care to comment? <-QUOTE}

Not having ever dealt with AOL I can't say, but don't hold your breath. SubSeven scans are quite common and harmless if you have a firewall in place.

Regards,

CrazyM