One computer on network blocking attempts

I have 4 pcs networked using a router. I also run Zone Alarm, mostly for
outbound monitoring.

My machine, running win2K has NO logs in Zone Alarm about blocking inbound
attempts.

However, my daughter who has Winxp does indeed show in ZA, x number of
blocked attempts. I checked the ip's on those to ensure they weren't from
the home network, and sure enought some are from outside.

Could this be from her running AIM or one of the P2P file programs? I just
find it odd that I have none and she has several. (NOT as many as my mom
at her house running Cable Internet, no router (I did load her ZA, who as of
Christmas had over 16,000 attempts!)

Colin
Thu Jan 27 16:57:20 CST 2005


"shcr" <bizeesheri@aol.com> wrote in message
news:e540bDLBFHA.2192@TK2MSFTNGP14.phx.gbl...
>I have 4 pcs networked using a router. I also run Zone Alarm, mostly for
> outbound monitoring.
>
> My machine, running win2K has NO logs in Zone Alarm about blocking inbound
> attempts.
>
> However, my daughter who has Winxp does indeed show in ZA, x number of
> blocked attempts. I checked the ip's on those to ensure they weren't from
> the home network, and sure enought some are from outside.
>
> Could this be from her running AIM or one of the P2P file programs? I
> just
> find it odd that I have none and she has several. (NOT as many as my mom
> at her house running Cable Internet, no router (I did load her ZA, who as
> of
> Christmas had over 16,000 attempts!)
>
>

Is the router configured to forward any traffic to your daughter's machine?
(this is required to make some p2p apps work properly... and these
'attempts' are usually harmless if they are just generated from other p2p
nodes trying see if your daughter's node is still available)

Steven
Fri Jan 28 00:18:08 CST 2005

It might help if you can tell what ports they are trying to access and the
source ports. The other thing to do is scan her computer for malware and
parasites being sure to use updated definitions on the programs you use. It
may also help to put some of those IP addresses in the address bar in
Internet Explorer so see if they bring up a website they may help solve the
mystery, or use ping to try and resolve the IP address to a name. I know
the Sygate firewall has a "traceback" function to entries that the firewall
logs that does a whois as part of the traceback.. Some internet applications
need somewhat complicated firewall rules to work correctly and maybe she is
trying to access such but the firewall is blocking return traffic.--- Steve


"shcr" <bizeesheri@aol.com> wrote in message
news:e540bDLBFHA.2192@TK2MSFTNGP14.phx.gbl...
>I have 4 pcs networked using a router. I also run Zone Alarm, mostly for
> outbound monitoring.
>
> My machine, running win2K has NO logs in Zone Alarm about blocking inbound
> attempts.
>
> However, my daughter who has Winxp does indeed show in ZA, x number of
> blocked attempts. I checked the ip's on those to ensure they weren't from
> the home network, and sure enought some are from outside.
>
> Could this be from her running AIM or one of the P2P file programs? I
> just
> find it odd that I have none and she has several. (NOT as many as my mom
> at her house running Cable Internet, no router (I did load her ZA, who as
> of
> Christmas had over 16,000 attempts!)
>
>