TCP session?

[trs80]

Im monitoring router traffic on my home network through the Linksys
firewall. I see lots of TCP "Outs" (in green) permitted from one of the PCs
on the network but no "INs". Does this mean that the "Out" really
represents an exchange of data through that port or both input and output
data as long as the session is valid?

I also see lots of Red "Ins" that are blocked and show Cable Modem IP vs PC
IP so I assume those hit the fireware and were rejected becuase there was
not an associated request first to open a session?.

Is that even close?

thanks for any insight
Im using Wall Watcher to montor router firewall data.

thx

 

[Guest]

Hi,

--
2nd Law of Thermodynamics: Chaos will Reign.

///////////////////
--Anthrax--
//////////////////

Im monitoring router traffic on my home network through the Linksys
firewall. I see lots of TCP "Outs" (in green) permitted from one of the
PCs on the network but no "INs". Does this mean that the "Out" really
represents an exchange of data through that port or both input and output
data as long as the session is valid?

Unless you are uploading a file or using an application that requires
intensive commincation trough the internet on that machine, chances are that
there's a trojan or virus in that machine. In the packet's that go out are
they using always the same port with random ips? maybe you can trace what's
the programm, service, virus or trojan based on that information. An out
packet not necessarily means that the tcp connection has being establish,

I also see lots of Red "Ins" that are blocked and show Cable Modem IP vs
PC IP so I assume those hit the fireware and were rejected becuase there
was not an associated request first to open a session?.

Not necessarily, there are a lot of reasons why a firewall will block a
packet among those access lists.

Is that even close?

Nope, first advice would be to check your FW configuration