Hi everybody!
I have a problem while using Comodo Firewall (Version 2.3.6.81) to watch multicast video provided by my ISP.(Actually it is a Internet TV and use Internet Explorer + Flash to watch it.)
I have set allowed IGMP in the network control rules and allowed ANY IP In/Out for the server IP.
But when I start to watch the video , the firewall said DDOS attack (UDP Flood) from the server IP address and blocked it.
Can I watch the video without shutdown the firewall?
If yes ,how to set it?
Sorry for my poor English.
Thanks!
Welcome to the forum.
Go to security/advanced/advanced attack detection and prevention, and increase the values for traffic level to 100 packets/second. If it’s not enough, increase it some more. Try until you find a level the works.
Thanks AOwL™. (:LOV)
I can watch the video now,but is it a security risk to allow IGMP and increase the DDOS traffic level to 350 packets/second?
Also, I have another question. The firewall sometimes logged and blocked my ISP DNS server since it has a UDP port scan to my computer, but I asked the technician in the ISP he said it is the firewall configuration problem.Is it my configuration problem or the ISP is doing some port scan to find the user using p2p?
Here are some logs in comodo firewall.
Severity :High
Reporter :Network Monitor
Description: UDP Port Scan
Attacker: -------------
Ports: 13579, 4363, 4619, 4875, 5131, 5387, 5643, 6667, 6923, 7691, 7947, 8203, 8459, 9227, 9483, 9739, 9995, 11019, 11275, 11787, 12299, 12555, 12043, 12811, 13067, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
The attacker has been temporarily blocked
Severity :High
Reporter :Network Monitor
Description: UDP Port Scan
Attacker: -------------
Ports: 22025, 12809, 13065, 13321, 13577, 14345, 14857, 15369, 15625, 15881, 16137, 16905, 17161, 17417, 17929, 17673, 18185, 18441, 18697, 18953, 19209, 19721, 19977, 20745, 21769, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
The attacker has been temporarily blocked
Severity :High
Reporter :Network Monitor
Description: UDP Port Scan
Attacker: ------------
Ports: 13574, 60165, 60677, 61445, 61701, 64517, 262, 774, 1030, 2822, 3078, 3334, 9990, 10502, 11014, 11270, 11526, 9734, 11782, 10246, 12038, 12294, 12806, 13318, 13830, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
The attacker has been temporarily blocked
Thanks very much.
Do you get those UDP port scan logs, even after you have set it to 350?
So far not.
The firewall logged 2 port scan from it when the firewall blocked the streaming server before I set to 350 and wait the firewall unblocked the streaming server.
But I don’t know why I haven’t watch the streaming before but still logged the UDP port scan form the DNS server.