Firewall issue (Sygate)

Printable View

October 18th, 2002, 11:01 PM
Ice9

Firewall issue (Sygate)

Hi, I recently discovered something very strange happening with regards to my firewall.

I use "Sygate Personal Firewall", and I noticed that when my computer was idle, I was seeing traffic being blocked in the firewall icon far more often than normal.

So I just looked in the log and I see what was going on, and I discovered 100s of hits, all from the same IP (10.x.x.x), all going to the "Destination Host" 255.255.255.255 on my machine. The rate of hits seems random, but I get about 5 per minute on average. I have a cable connection and just got a new modem from my ISP, and I think the problem has only been happening since then, but I can't be sure.

I don't think anything malicious is going on, but this can't be normal. It might be some issue between my ISP and myself, and I would appreciate any help stopping this, because it is very annoying.
October 19th, 2002, 02:06 PM
Adriweb

Do you have a home network? A 10.x.x.x address is a private address.
It is probably not coming from your isp. That address may be the firewall testing itself.
October 19th, 2002, 07:03 PM
Pakrat

I'm not completely clear on this, but cable modems use an internal IP, this way the cable company can check on the modem.

Do a tracert to yahoo.com or something, What I get is a 10.x.x.x address as the first hop.
October 19th, 2002, 10:41 PM
Ice9

Quote:

Originally posted by Pakrat
I'm not completely clear on this, but cable modems use an internal IP, this way the cable company can check on the modem.

Do a tracert to yahoo.com or something, What I get is a 10.x.x.x address as the first hop.

Thanks Pakrat, that was a good idea.

That 10.x.x.x address was indeed the first hop on the tracert, so the idea that is an "internal" IP makes sense.

I still don't get why modem is trying to connect with "255.255.255.255" though. I did check my "winipcfg" and my subnet mask shows up as "255.255.255.0". I don't know if that has anything to do with this or not.
October 19th, 2002, 11:45 PM
Newt

Unless you are trying to set up an internet server with lots of aliases, you are almost certainly seeing the efforts of a script kiddy to work with a trojan. If you ain't got a trojan, you are safe. If your firewall is blocking the stuff, you are safe.