Routed traffic?

In addition to posting some log entries like CrazyM asked, can you also tell us what type of network and ISP connection you have? Dialup? DSL? Cable? Do you have a LAN or a router?

The standard response given when you ask about seeing "fwroute" entries in the ZA log is that these are from packets being "routed through your computer" which can occur when running ZA on certain types of networks or on a gateway machine (i.e. if you were running ICS on your PC and had other systems using it as their gateway).

I used to see these myself though I run no LAN, ICS or any routing at all. It took a little tracking down but ended up being an odd form of ISP generated housekeeping traffic. I believe I traced it to a type of keepalive that my ISP was using. It was very precise and patterned...

At exactly the same minute and second every hour a single fwroute alert would popup in ZAP. The packet was always from an odd IP address to an odd IP address. (I believe they were in the reserved block: 112.0.0.0/5)

I'm on ADSL using PPPoE and it turns out that those blocked fwroute packets were related to some underlying protocol requirement for my ISP connection. In fact, the setting in ZAP that was required to prevent these alerts turned out to be one that many other people on some types of ADSL needed to set for overall network health. It's the one circled in the image below from ZAP > Firewall panel > Main tab > Advanced button > check "Allow uncommon protocols at high security".

But, this is just one specific example. Yours could be entirely different depending upon your network and ISP setup.

 

The two options on that screen that block servers override the ability for any program on your system to get "server rights". In ZA terms, granting a program server rights, (via a pop-up program alert, or in the program list in the Program tab), means that you are allowing it to be connected into from people out on either the Internet or from the sites in your Trusted Zone.

File sharing applications are a good example of programs that ask for server rights. (They do it in order to allow people out on the Internet to get access to the files you allow them to take from your system.) So, checking those two options, "block local servers" and "block Internet servers", will override any time you gave a program server permission.

So, yes, checking those two options does make you more secure in that you will block all programs (whether allowed previously or not) from acting as a server and getting unsolicited connections from the network.

 

Hi sir_carew,

Could you actually go into the text log file itself and copy out the line that reflects this log viewer alert? The ZA log files are usually in this location and can be opened in Notepad:

c:\windows\Internet Logs\ZALog.txt

Edit: A routed packet should not contain your actual IP address in it, but if it does, just xxx out the last two sets of numbers but post the rest. It'd be interesting to see the whole line.

 

Well, that is extremely interesting...

[pre]FWROUTE,2003/12/11,19:04:34 -3:00 GMT,127.0.0.1:80,200.30.202.145:1861,TCP (flags:AR)[/pre]The one in the image above was from and to IP addresses not your own, but which are most likely other users on your ISP. This one is from localhost:80 - that is odd. (Do you run a local webserver on your system?)

I know there are many conditions in networking where a system might see packets that are not meant for it, but are visible based upon how the packets were sent or how the network is laid out, but that's the limit on my level of understanding on this. We'd probably need someone with some real networking knowledge to explain it further.

Of course, (and I know you already know this, but for the benefit of others reading here), all packets logged in this fashion by ZA are being blocked, so there is no exposure here. The only time most "routed" packet alerts (from one external address to another) would be a concern is if the volume were very very large. In which case there might be bandwidth issues to think about. The odd routed packet block is not a big thing.

But, this one from 127.0.0.1:80 is very interesting.

 

Well, nothing is 100% certain, but I'm not really leaning towards hacker activity at all on this for a couple reasons.

First, because as I said there are many conditions where routed packets can be seen on a system, especially for cable users. (While all ISPs are different, many times in cable networks an individual customer may see traffic pass by that is from their neighbors. If your cable modem light flashes a lot even when you've powered you PC down, then most likely you are seeing the activity of neighbors who share that cable network segment.)

Second, these are being blocked by ZA which means they are not any danger to your system, and of no value to anyone who might be sending them deliberately.

So, my opinion at this point is this is more a curiosity then anything else.

 

Well, yes and no. All ISPs provide "shared bandwidth" in one way or the other. DSL users rarely see their activity lights flash except for packets coming to or going from their systems, but still the bandwidth is shared, usually at some point just beyond where their digital line terminates at the nearest connection point to the provider. On many cable systems though, the activity can often be seen (by the flashing lights) because you and your neighbors are on a shared network segment...

They aren't really using your bandwidth. It's shared bandwidth made available to all people on that segment. So long as you get at least the minimum contracted transfer rates (up and down) the cable provider is fulfilling their end. It just the way most cable ISPs work.