Portscans

Discussion in 'Windows Desktop Systems' started by Ferral_Imp, Jan 13, 2005.

  1. Ferral_Imp

    Ferral_Imp Moderator

    Messages:
    685
    Location:
    PA
    Ok this is really getting to annoy me. For a while now I've been getting random port scans from the same ip address. At first these scans would occur maybe once or twice a week at most but now they're up to 3 and 4 port scans a day at times(Norton blocks the little pest for 30 mins after the scan which prob limits their tries) It doesn't seem to matter where on the web I am or what I am doing at the time of the scan but they all seem to start after I've been online for at least an hour and they only occur after 11 pm from what I've observed. I used Norton's tracking service to find out the ip address originates from somewhere in Vermont.

    Is there anyway to prevent the scans other than stealthing my ports (which I already did) cuz I'm getting tired of all the warnings popping up.
     
  2. Weasel

    Weasel Define 'Cynical'

    Messages:
    163
    Location:
    Sammamish, WA
    Block the IP completely. Not sure if Norton has that ability but look around for it.
     
  3. Maveric169

    Maveric169 The Voices Talk to Me

    Messages:
    1,148
    Location:
    Elkhart, IN
    I use McAfee, and have had the same problems. I just banned the IP so no matter what it won't accept a connection from it, but I can still see it "knocking" on the door. You might also change your alert notification to high alerts only.
     
  4. Kr0m

    Kr0m Moderator

    Messages:
    1,390
    Location:
    Turtle Island
    This is one of the reasons I chose my ISP since they're adsl w/ PPPOE. If I see suspicious activity hitting my IP all I need to do is disconnect and connect again and get assigned a new IP. Only downside to this is that sometimes I'll get assigned an IP that a previous user had and was sharing on some P2P network and I'll see some leftover packets.
     
  5. Ferral_Imp

    Ferral_Imp Moderator

    Messages:
    685
    Location:
    PA
    Weasle and Maveric,

    Where would I look to see if Norton would allow this?


    Kr0m,

    I'm on dial-up
     
  6. Weasel

    Weasel Define 'Cynical'

    Messages:
    163
    Location:
    Sammamish, WA
    I have no idea; I don't even know what Norton Internet Security looks like. I'm just assuming that it has an option (somewhere) to completely block an IP since it wouldn't really be a proper application without that feature.
     
  7. RickyC

    RickyC OSNN Addict

    Messages:
    199
    Location:
    Earth
    Open NIS, click Personal Firewall, click 'Configure' (bottom right corner), click Advanced and then click General Rules and Add. From here you can block incoming, outgoing or both using Port number or IP address using the wizard.
     
  8. Ferral_Imp

    Ferral_Imp Moderator

    Messages:
    685
    Location:
    PA
    Thanks RickyC. I'll do that when I get a chance to dig up the ip address in a bit.



    EDIT: I found the option under the network tab to either put them in the trusted zone or the restricted zone (in other words blocked). Thanks
     
  9. Ferral_Imp

    Ferral_Imp Moderator

    Messages:
    685
    Location:
    PA
    Well looks like blocking them isn't going to work cuz the little bugger already came back with a different ip already. Guess I'll just either have to get used to them or slowly block out the little pest's whole ip range in norton.