router alarm

Discussion in 'NOD32 version 2 Forum' started by Pieter_Arntz, Aug 7, 2008.

Thread Status:
Not open for further replies.
  1. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,332
    Location:
    Netherlands
    Hi,

    I received the following:
    A whois leads to:
    Host eset.com
    Location US, United States
    City San Antonio, TX 78229

    Could this be caused by one of my computers fetching updates for NOD23?
    I know it's nothing to worry about, but the port number seems strange for updates. ;)

    Thanks in advance.

    Pieter
     
  2. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Hi Pieter,
    www.eset.com does not host update files so there should be no connection with updates. It looks like someone has attempted to access our website www.eset.com and the attempt was blocked, but I can't tell why - it looks like a normal connection to our server on port 80 and not a reverse connection attempt from our server.
     
  3. Stijnson

    Stijnson Registered Member

    Joined:
    Nov 7, 2007
    Posts:
    533
    Location:
    Paranoia Heaven
    Hi Pieter,

    on what kind of router (brand and model) was this?
     
  4. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,332
    Location:
    Netherlands
    Thanks for looking Marcos :)
    That's what I figured.

    Stijnson,

    It's a Siemens Gigaset SX553 WLAN dsl
     
  5. Stijnson

    Stijnson Registered Member

    Joined:
    Nov 7, 2007
    Posts:
    533
    Location:
    Paranoia Heaven
    OK, just out of curiosity: what caused this message from your router?
    If I understand it correctly a connection to ESET's page was made from one of your own computers. Why was the connection attempt blocked?

    Are these kind of router messages something to worry about?
     
  6. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,332
    Location:
    Netherlands
    As the alarm says they are not always cause for worries, but I do occasionally check out the IP if I see a new one. (I get about 10 of those messages per week)

    I have the alarms enabled so I can spot if and when someone is doing portscans.
     
  7. Stijnson

    Stijnson Registered Member

    Joined:
    Nov 7, 2007
    Posts:
    533
    Location:
    Paranoia Heaven
    OK, thanks. Wouldn't these scans appear in the router's log files anyway (so with alarm turned off)?
     
  8. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,332
    Location:
    Netherlands
    I think so, yes, but I'm not sure for how long they will be stored.
    These get mailed at the end of the day I guess, because I always get them a few at a time and I read them for breakfast. :)
     
Thread Status:
Not open for further replies.