new firewall alerts

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Hi I am on a laptop running XP SP3, and have recently been getting repeated
Security Alerts from my Zone Alarm firewall. I was at the time traveling
and thought that the insecure hotel networks might have been the problem,
but I am now back home - using my home wireless network which connects to
the internet via a router - and I am still getting these alerts.

The alerts inform me that ZA has blocked incoming access to my PC and have
the following text:

1. The firewall has blocked local network access to you computer [TCP Port
2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]

2. same but with [TCP Port 2176]

3. same but with [TCP Port 2177]

What if anything should I do about this? I know I did not get these alerts
before I set out on this trip. I've checked for malware and for viruses and
am apparently clean.

I have no idea what TCP Port 2176, 2177, or 2178 represent.

Jeff
 
Hello,

First an explanation of the message you are receiving...
The firewall has blocked local network access to you computer [TCP Port
2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]
Click to expand...
Click to expand...

192.168.x.x is a private network block and in this case most likely is your
own router (192.168.1.1).
It is sending a SYN packet (TCP Flags: S) to try to open a connection using
the router's temporary port range incrementally (port 2175, 2176, 2177,
ect).
That SYN packet to open a connection is going to your computer's port
TCP/2869. This port has been known to be used by Microsoft Windows Universal
Plug and Play (Automatic configuration of network devices, including
computers, routers, and firewall settings).

I have no idea what really changed in your configuration that would allow
you to see such messages but this seems to be either a configuration error
of ZoneAlarm or something turned on Universal Plug and Play in your computer
and/or router recently.



Hi I am on a laptop running XP SP3, and have recently been getting
repeated Security Alerts from my Zone Alarm firewall. I was at the time
traveling and thought that the insecure hotel networks might have been the
problem, but I am now back home - using my home wireless network which
connects to the internet via a router - and I am still getting these
alerts.

The alerts inform me that ZA has blocked incoming access to my PC and have
the following text:

1. The firewall has blocked local network access to you computer [TCP Port
2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]

2. same but with [TCP Port 2176]

3. same but with [TCP Port 2177]

What if anything should I do about this? I know I did not get these
alerts before I set out on this trip. I've checked for malware and for
viruses and am apparently clean.

I have no idea what TCP Port 2176, 2177, or 2178 represent.

Jeff
Click to expand...
 
Thank you very much Mark. That is very helpful.

Is turning on Universal Plug and Play a good idea? Should I turn it off and
if so how?

Not sure what the change was but I did have recent Zone Alarm and Windows XP
updates, so either could be at fault.

Incidentally, subsequent to your kind response I checked the Zone Alarm
settings, and I see that I do have 192.168.1.1 in the trusted zone as "DHCP
and DNS servers". So this is weird and I will ask the ZA forum about it.

Jeff


Mark Brown said:
Hello,

First an explanation of the message you are receiving...
The firewall has blocked local network access to you computer [TCP Port
2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]
Click to expand...
Click to expand...

192.168.x.x is a private network block and in this case most likely is
your own router (192.168.1.1).
It is sending a SYN packet (TCP Flags: S) to try to open a connection
using the router's temporary port range incrementally (port 2175, 2176,
2177, ect).
That SYN packet to open a connection is going to your computer's port
TCP/2869. This port has been known to be used by Microsoft Windows
Universal Plug and Play (Automatic configuration of network devices,
including computers, routers, and firewall settings).

I have no idea what really changed in your configuration that would allow
you to see such messages but this seems to be either a configuration error
of ZoneAlarm or something turned on Universal Plug and Play in your
computer and/or router recently.



Hi I am on a laptop running XP SP3, and have recently been getting
repeated Security Alerts from my Zone Alarm firewall. I was at the time
traveling and thought that the insecure hotel networks might have been
the problem, but I am now back home - using my home wireless network
which connects to the internet via a router - and I am still getting
these alerts.

The alerts inform me that ZA has blocked incoming access to my PC and
have the following text:

1. The firewall has blocked local network access to you computer [TCP
Port 2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]

2. same but with [TCP Port 2176]

3. same but with [TCP Port 2177]

What if anything should I do about this? I know I did not get these
alerts before I set out on this trip. I've checked for malware and for
viruses and am apparently clean.

I have no idea what TCP Port 2176, 2177, or 2178 represent.

Jeff
Click to expand...
Click to expand...
 
Could my having "upgraded" to I.E.8 recently and then removed it and
manually installed I.E. 7 be the cause of the new alerts?

Jeff

Mark Brown said:
Hello,

First an explanation of the message you are receiving...
The firewall has blocked local network access to you computer [TCP Port
2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]
Click to expand...
Click to expand...

192.168.x.x is a private network block and in this case most likely is
your own router (192.168.1.1).
It is sending a SYN packet (TCP Flags: S) to try to open a connection
using the router's temporary port range incrementally (port 2175, 2176,
2177, ect).
That SYN packet to open a connection is going to your computer's port
TCP/2869. This port has been known to be used by Microsoft Windows
Universal Plug and Play (Automatic configuration of network devices,
including computers, routers, and firewall settings).

I have no idea what really changed in your configuration that would allow
you to see such messages but this seems to be either a configuration error
of ZoneAlarm or something turned on Universal Plug and Play in your
computer and/or router recently.



Hi I am on a laptop running XP SP3, and have recently been getting
repeated Security Alerts from my Zone Alarm firewall. I was at the time
traveling and thought that the insecure hotel networks might have been
the problem, but I am now back home - using my home wireless network
which connects to the internet via a router - and I am still getting
these alerts.

The alerts inform me that ZA has blocked incoming access to my PC and
have the following text:

1. The firewall has blocked local network access to you computer [TCP
Port 2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]

2. same but with [TCP Port 2176]

3. same but with [TCP Port 2177]

What if anything should I do about this? I know I did not get these
alerts before I set out on this trip. I've checked for malware and for
viruses and am apparently clean.

I have no idea what TCP Port 2176, 2177, or 2178 represent.

Jeff
Click to expand...
Click to expand...
 
Back
Top