Firewall blocking random stuff inc/ IPv6

I recently found that there's a hardcoded rule for allowing all ICMPv6 communication which obviously isn't working at all.
I get a whole lot of "no usable rule found" spam when running uTorrent 1.9 from ICMPv6, originating from system.

Just wanted to add some IPv6 info:
PID=4, that's system, not sure why it doesn't just say system
The pings appear to happen on vista bootup/login.



In particular

• Random blocked web data?
• Other PC sending data to itself that I can see?
• ..then sending it to a non existing IP?
• ..then finally to the router, why can I see it?
• System sending IGMP?

 

bump.

Bump.

 

Same as I but ESSET Support says turn off logging
I dont have time I spend solving problems with v4 maybe 2 months.
Now I am on v4 but I am waiting for good build or end of licence.

 

I have the same problem... I disable IPv6...

 

Personally I just keep bumping this until they fix it, it's worked in the past so. I know they're busy but they get around to it eventually.

 

Yes that is true. But do you think that is good idea for future?

When IPv6 comes than I think will be more other problems why ESET Developers should'nt fix this now?

BUMping is not good way but for other side releasing ESET SS v4 was not good idea. For me it is not full product its still very buggy.

 

Bump.

 

buggy...

 

Hello elapsed,

There is a new firewall module avaliable now. You should have received it automatically with an update. Does the problem still persist after this update?

 

A bi-directional rule for icmpv6 (port 5 should help. The rule will be made default in the module build 1048.

 

I can tell you now:
IPv6: Not fixed, fixed in 1048 according to Marcos
Random blocked TCP packets: Not fixed, may be firewall performing properly? I'd rather have an ESET reply.
Data sent to non-existant IPs/Data being sent from other IP's I can see: Still investigating with new module, will report back.
Random IGMP: Still investigating with new module, will report back.

 

Same problems here. Somtetimes thunderbird didn't work, sometimes internet explorer didn't work. Vista with SP2 hang or so slow reaction to commands,.... Installation was no problem but my pc couldn't be used.
No internet connection at all. No online update of ESS possible because no internet connection available. Problems with ESS 4.0.437 and 4.0.424 with Vista SP2. With XP and SP3 I hadn't problems.

Now it's enough !!!

After many spent time I removed ESS and installed NOD32 with comodo firewall. My pc is now running fast and I can use internet again.

I am not satisfied with the new version 4.

Still very buggy version like a beta version and not stable or really useful.

ESET please do your homework.

 

Bump.

None of these issues are fixed in 1049. Infact I'm having another issue where ESS is blocking a TON of legitimate data from the World of Warcraft patching system, this system uses torrenting traffic, and a lot is simply being blocked for what I see as no apparent reason.

Usually:
Time Packet blocked by active defense (IDS) 192.168.XX.XX:RANDOM_PORT XX.XX.XX.XX:3724 TCP
or
Time Packet blocked by active defense (IDS) XX.XX.XX.XX:3724 192.168.XX.XX:RANDOM_PORT TCP

Your firewall is becoming a joke to me ESET.

 

Time Detected ICMP Flooding attack XX.XX.XX.XX 192.168.XX.XX ICMP

Fun fact, my router is set to block incoming ICMP from externals addresses, wonder how ESET thinks I'm being attacked, eh?

 

Hello,

Please enable logging mode to capture the blocked packets and forward them to support@eset.sk along with a link to this message for further analysis.

Regards,

Aryeh Goretsky

 

"Logging mode"? An explanation would be nice. If you mean log blocked connections, it's already enabled, and that doesn't capture packets.

 

Hi elapsed,

I believe he's he's referring to this. http://kb.eset.com/esetkb/index?page=content&id=SOLN742

BFG

 

Even more fun in ESET land where I need to guess KB articles, those instructions are broken:

1. The directory is actually: HKLM\SOFTWARE\Eset\ESET Security\CurrentVersion\Plugins\01000200\Profiles\@My profile
2. The Vista directory is: C:\ProgramData\ESET\ESET Smart Security\ which isn't even listed

That being said, I've started creating a log. I highly doubt I can replicate the ICMP issue, but I can replicate the torrenting and IPv6 issue.

 

Hello,

Thank you for letting us know. I'll forward that information to the tech writers.

BFG

 

I've sent the file

I really hope this helps.

 

This gets funner by the day. I just got a brilliant reply from customer support: "Your email request does not contain a valid ticket number". Are you serious? I only just sent the email why would I have a ticket number....

 

Maybe someone could explain to me what I'm supposed to do now?

 

In my opinion,IGMP is normal.because,as far as I know,when each computer starts,it will send a data which is IGMP to a same target.But I don't know why.
And that TCP packet may be a packet with some special flags set like SYN.

 

Hello elapsed,

How did you try to contact support, the way they recommend via the GUI of the program? As the last way sounds like it didn't create a case you might try that.

BFG

 

Sounds like a good explanation, but in this case, a better log entry should be created, it currently has the misleading message of "No usable rule found" as an excuse for blocking.

That being said, I have notice it pop-up frequently whilst running uTorrent.