For about the last 2 hours or so I keep getting the same alerts from CPF. Is someone trying to hack my computer or is there a simpler explanation? All suggestions welcome. Thanks in advance,
rubi
Here is a log:
Date/Time :2007-01-18 16:06:57
Severity :High
Reporter :Network Monitor
Description: Blocked by Protocol Analysis (Fragmented IP Packet)
Direction: IP Incoming
Source: 62.90.5.1
Destination: 172.25.246.159
Protocol : UDP
Reason: Fragmented IP packets are not allowed
Date/Time :2007-01-18 16:06:57
Severity :High
Reporter :Network Monitor
Description: Blocked by Protocol Analysis (Fake or Malformed UDP Packet)
Direction: UDP Incoming
Source: 62.90.5.1:1701
Destination: 172.25.246.159:1701
Reason: UDP packet length and the size on the wire(1520 bytes) do not match
It’s always the same two alerts in combination. As I said, this has been going on for about two hours now.
Thanks guys (:WAV)
Have you installed any new software recently, and/or are you running any software over the past two hours, that is connected to the “Source” IP address?
If you go to Network Monitor, double-click the “Out” rule for TCP/UDP, and check the box “Create an Alert if this rule is fired.” Ok. Reboot computer to clear memory and set the rule change.
Then you can check your logs to see if you have any outbound connections to that IP address; that may help resolve the issue.
Here’s the thing to help your worries… regardless of whether someone is trying to hack you or not, rest easy in the text “Blocked by Protocol Analysis.” The connection attempt is not getting on your computer.
Thank you very much Little Mac (:CLP)
After my original post, I searched the IP address and realized it had something to do with my ISP. Why I don’t know of course, but it’s irrelevant now. I did, in fact, restart the computer (without making changes) and the problem is resolved. And yes, despite the paranoia, I am actually very much relieved, and impressed, that CPF is doing such a great job. I also think it’s fantastic that you, and the other moderators, are doing such a fantastic and professional job responding to paranoid, or just plain inexperienced, users like myself. Keep up the good work! :■■■■
rubi