I downloaded Comodo Firewall earlier today and have been keeping track of the Active Connections window while browsing throughout the day just to get a sense of its behavior. Here is something I noticed: whenever I opened a folder on my desktop, a new connection opened labeled, “System (4)” with bytes headed out.
So perhaps stupidly, I Googled the recipient IP address and clicked the first link without really thinking, to a site called ip-adress.com, which I only now notice has only a single d in the name, which could apparently tell me what it was from. But with all the cataloged IP’s, it made me feel a bit uncomfortable so I closed the browser window. Then a moment later, Comodo told me it had encountered a bug and needed to close. This worried me a bit, so on a whim, I restarted my computer in safe mode and did scans with AVG, Malwarebytes and Spybot S&D, but none of those picked anything up so… I dunno.
So,
What’s with the “System” connection when I open things? At a glance, I’d guess it’s going to my ISP, which is probably pretty normal for stuff. Since I’ve rebooted (now out of safe mode, of course), it doesn’t seem to be doing it now, but it’s still a tad concerning.
Related to the little tizzy Comodo had, could something bad have happened when I interfaced with that site? Being a site about IP’s, I’m worried it logged information or something.
On that note, is there a way I can change my IP? My network settings say it’s set to automatically acquire one, but after doing the thing where you disconnect your modem for a while and reboot it, mine never seems to change.
Any other thoughts?
I’m sure this stuff is pretty dumb, but I’m just a little concerned and would feel better with whatever you guys can tell me. Thanks a lot.
I’m unable to reproduce these connections by using the method described, but seeing certain types of traffic from/to the System process is normal. Typically, the System process, amongst many other things, is responsible for connectivity using Microsoft File and Printer Sharing protocols (NetBIOS/SMB) For example, if you have two PC’s on a LAN you will see traffic over ports UDP 137 and TCP 139/445, as the share information about themselves.
If you’re not behind a router, or you only have a single PC, it’s probably a good idea to contain NetBIOS. If you need file and printer sharing, you can create rules to allow the traffic on the LAN only. If not, you can disable NetBIOS on the properties of the network adapter.
2. Related to the little tizzy Comodo had, could something bad have happened when I interfaced with that site? Being a site about IP's, I'm worried it logged information or something.
Probably a coincidence, as the site in question is quite legitimate. You can run More/Diagnostics to check for any problems.
3. On that note, is there a way I can change my IP? My network settings say it's set to automatically acquire one, but after doing the thing where you disconnect your modem for a while and reboot it, mine never seems to change.
That really depends of your ISP. Some allow for users to change their IP addresses at will, whilst others use very long, if not permanent lease times. if you don’t get a new IP address after resetting your modem, it’s likely your ISP allocates you a long term address.
Thank you very much for the timely and good response.
I'm unable to reproduce these connections by using the method described, but seeing certain types of traffic from/to the System process is normal. Typically, the System process, amongst many other things, is responsible for connectivity using Microsoft File and Printer Sharing protocols (NetBIOS/SMB) For example, if you have two PC's on a LAN you will see traffic over ports UDP 137 and TCP 139/445, as the share information about themselves.
If you’re not behind a router, or you only have a single PC, it’s probably a good idea to contain NetBIOS. If you need file and printer sharing, you can create rules to allow the traffic on the LAN only. If not, you can disable NetBIOS on the properties of the network adapter.
The stuff about the system process makes sense. I’m not connected to any printers nor to any other kind of machine or computer. As far as my connection, I just have a cable hooked up to a modem. I’m not sure if that’s what you would call ‘behind a router,’ I’m not very good with terminology, I’m afraid. What exactly are the NetBIOS and what are they responsible for? I tried looking for options related to them around my network settings but couldn’t see anything related to them. I’m running Vista, if that makes any difference.
Probably a coincidence, as the site in question is quite legitimate. You can run More/Diagnostics to check for any problems.
With all the options it had surrounding IP’s, the site just weirded me out. But Comodo’s not showing any errors after the diagnostic, so I guess that’s that.
That really depends of your ISP. Some allow for users to change their IP addresses at will, whilst others use very long, if not permanent lease times. if you don't get a new IP address after resetting your modem, it's likely your ISP allocates you a long term address.
I see. I’ve just heard about all sorts of methods such as a “force change,” so I thought I would ask. Well, if I’m stuck with this IP, I suppose I should take care of it. Are there any bread and butter methods of IP protection I should be aware of, in case I actually do stumble across some evil internet domain? Comodo offered some sort of special DNS usage feature when I installed it, but I opted out.
If it’s just a box issued by your ISP, and it has just a single connection for the PC, it’s probably a modem.
What exactly are the NetBIOS and what are they responsible for? I tried looking for options related to them around my network settings but couldn't see anything related to them. I'm running Vista, if that makes any difference.
I wouldn’t worry to much about the terminology, NetBIOS is just a set of protocols and ports that allows file and printer sharing. As you’re only using a single PC, you can disable NetBIOS as seen in the image.
With all the options it had surrounding IP's, the site just weirded me out. But Comodo's not showing any errors after the diagnostic, so I guess that's that.
As I said, the site is legitimate, so no need to worry.
I see. I've just heard about all sorts of methods such as a "force change," so I thought I would ask. Well, if I'm stuck with this IP, I suppose I should take care of it. Are there any bread and butter methods of IP protection I should be aware of, in case I actually do stumble across some evil internet domain? Comodo offered some sort of special DNS usage feature when I installed it, but I opted out.
Comodo offer a service called Secure DNS, It’s a free service and you can read more about it at Comodo SecureDNS the basic idea is protect you from malware sites and to provide content filtering.