port scanned

Discussion in 'other firewalls' started by INTOXSICKATED, Apr 9, 2005.

Thread Status:
Not open for further replies.
  1. INTOXSICKATED

    INTOXSICKATED Registered Member

    Joined:
    Jan 29, 2005
    Posts:
    485
    Location:
    Suburbia Hell
    i keep getting a re-occuring attack detection report from outpost pro. over the last week or so, this message pops up and kills my internet connection every hour or so. i can go into outpost and manually unblock it, but does anyone know what causes it? what exactly does this mean? any help in the right direction would be appreciated.
     

    Attached Files:

  2. TylerGred

    TylerGred Registered Member

    Joined:
    Mar 20, 2005
    Posts:
    69
    Location:
    USA
    I think the 192.168... addresses are for local networks? Are you on a local network, router, anything?
     
  3. Paranoid2000

    Paranoid2000 Registered Member

    Joined:
    May 2, 2004
    Posts:
    2,839
    Location:
    North West, United Kingdom
    Are you using a router to connect to the Internet? If so, then that address (192.168.1.2) could well be that of your router, so blocking it would certainly affect your Internet access.

    My guess is that (if this is a router) this is acting as your DNS server and the Outpost Attack Detection plugin is mistaking slow responses to DNS requests as unsolicited incoming connection attempts (I see this occasionally with my ISP's DNS servers). In this case you could either reduce the plugin's sensitivity (Attack Detection Properties/Alarm Level) or add this IP address as a Trusted Host (Attack Detection Properties/Advanced/Exclusions/Hosts).
     
  4. INTOXSICKATED

    INTOXSICKATED Registered Member

    Joined:
    Jan 29, 2005
    Posts:
    485
    Location:
    Suburbia Hell
    yea, i am using a microsoft router and the 192.168.1.2 is my gateway address. not exactly sure what that means.
     

    Attached Files:

  5. INTOXSICKATED

    INTOXSICKATED Registered Member

    Joined:
    Jan 29, 2005
    Posts:
    485
    Location:
    Suburbia Hell
    if i take your advice paranoid, which selection should i make here when i add my ip address?
     

    Attached Files:

  6. Paranoid2000

    Paranoid2000 Registered Member

    Joined:
    May 2, 2004
    Posts:
    2,839
    Location:
    North West, United Kingdom
    "Gateway" means that any traffic leaving your PC is sent to the router which then forwards it onto your ISP. As for the Trusted Host setting, you should select "IP number" (you are only entering one address) and the router address 192.168.2.1.
     
  7. INTOXSICKATED

    INTOXSICKATED Registered Member

    Joined:
    Jan 29, 2005
    Posts:
    485
    Location:
    Suburbia Hell
    thank you both for the replies. with your help, i think i got it figured out now.

    mr. paranoid: let me take this opportunity to thank you personally for all your hard work with the outpost firewall. after searching for quite some time to find a replacement for zonealarm, i came across outpost pro 2.5. your: A Guide to Producing a Secure Configuration for Outpost and Outpost 2.5 - what to expect are awsome posts that helped me get started and are something i constantly go back to for reference.
     
  8. Paranoid2000

    Paranoid2000 Registered Member

    Joined:
    May 2, 2004
    Posts:
    2,839
    Location:
    North West, United Kingdom
    "Mr Paranoid" ... LOL :D Thanks for the feedback though. :)
     
Loading...
Thread Status:
Not open for further replies.