Computing.Net > Forums > Security and Virus > Firewall detects intrusion from isp

Firewall detects intrusion from isp

Reply to Message Icon

Original Message
Name: Chunko
Date: May 1, 2003 at 05:34:37 Pacific
Subject: Firewall detects intrusion from isp
OS: windows xp home
CPU/Ram: Pentium2.4/768ddr333
Comment:

I have Norton 2003firewall protection and all up-to-date definitions and signatures.
I recieve around 10-15 intrusions per week(most of the listed as "High Threats").
I notice a lot come from my isp (Comcast).
After viewing many posts on this site,I came across a post with http://www.all-nettools.com/
I then did a scan from the intruder at allnettools and was given his email address.I believe this to be a malicious attack..After all it is from my isp,and oh yeah,the lateset instance of him trying to gain access to my pc is when I opened my outlook account.Im not sure what to report about him or,if to send an email to him.Non-the-less,I still feel he is personally trying to get into my computer.

I have been obssesing with the security of my pc the past three days or so,just disabling unneeded proccesses and ports.But I feel as if this may be a futile effort.
If that guy is indeed trying to get into my pc,what would be the best thing for me to do?Could I get the guy fired?Is it even a human at work?
Another thing which I found disturbing was that,the last time he tried to gain access(when I opened outlook),my firewall did not go into its standard procedure.It alerted me but when I checked the log,it listed the intrusion as;ipaddress will be blocked further accsess from your computer for thirty minutes(during that time,I could not open outlook but could still use the web).Why wasnt that intrusion listed as a normal intrusion in the firewall logs?
One more item which I came across when searching for answers;when I was doing a search for "broadband speed tests" on google,I noticed the second listed site was Houston RoadRunner online tests.That company has been trying to get into my pc almost ever since I bought my firewall but thats not it,read response4 newgrl http://computing.net/security/wwwboard/forum/364.html
Anyways,I know I have posted many questions in this one thread but I would be very greatful to those who can give some insight on any of the listed problems-concerns I am having,especially the isp guy who keeps trying to gain accsess.
In the meantime Im gonna block the multiple ip addresses I recieved from isp guy and get some rest.
As always,I thank you all for putting your time into helping us people out.
Peace.


Report Offensive Message For Removal

Response Number 1
Name: capt
Date: May 1, 2003 at 07:01:09 Pacific
Subject: Firewall detects intrusion from isp
Reply: (edit)

It is normal traffic from the ISP. ISP's constantly see how many people are using their services and for how long. Some ISP's even bill according to usuage. I have my firewall configured to prevent any attack, but to not notify me of the alerts. There are so many it that it becomes distracting. If you want to test your firewall to make sure it is doing its job, run the tests at PC Flank and the nano-probe test at the Gibson Research websites. Symantec also will test your security at their website using their free secuurity scan. I only recommend their scan that have Norton products, because there seems to be special attention paid to those who do not have "latest and commonly used virus products".


Report Offensive Follow Up For Removal

Response Number 2
Name: Tank863
Date: May 1, 2003 at 09:13:45 Pacific
Subject: Firewall detects intrusion from isp
Reply: (edit)

Chunko,

Capt is 100% correct on this.

I also use Comcast. However, I have a different set up than you. I use Zone Alarm Pro, with many different products for security added.

I have a wireless network setup and appears to be as secure as you can get a wireless network.

As far as Comcast goes. They use a DHCP (Dynamic Host Configuration Protocol.

DHCP is an Internet protocol for automating the configuration of computers that use TCP/IP. DHCP can be used to automatically assign IP addresses, to deliver TCP/IP stack configuration parameters such as the subnet mask and default router, and to provide other configuration information such as the addresses for printer, time and news servers.

Comcast checks to 'see' if you are online and connected. If you access your comcast account daily, you will retian the same IP address for sometime.

As far as Comcast goes, if you suspect a real hack..

How do I report security issues?
Gaining unauthorized access to computer systems for the purpose of stealing and corrupting data is called "hacking." Hacking is against the law. One way to protect yourself from hackers is to use firewall software. Most firewall software applications produce reports that will indicate if someone is trying to hack into your computer.

If you feel someone is trying to "hack" into your computer based on firewall reports, e-mail a copy of the firewall log, and any other details you can provide, to the abuse department of the hacker's ISP. Contact local authorities if there is any damage involved. Please send all reports of alleged service abuse by Comcast High-Speed Internet subscribers to abuse@comcast.net.

Every IP address has an owner. Visit http://www.arin.net/whois/ and look up what ISP owns that address. Reports generally get e-mailed to abuse@ that ISP.

Tank863


Report Offensive Follow Up For Removal

Response Number 3
Name: Chunko
Date: May 1, 2003 at 16:55:47 Pacific
Subject: Firewall detects intrusion from isp
Reply: (edit)

Thanks guys!You have proven to be of good insight as always.
Peace out(:


Report Offensive Follow Up For Removal







Use following form to reply to current message:

   Name: From My Computing.Net Settings
 E-Mail: From My Computing.Net Settings

Subject: Firewall detects intrusion from isp

Comments:

 


  Homepage URL (*): 
Homepage Title (*): 
         Image URL: 
 
Data Recovery Software