Zone Alarm Log Question

  • Thread starter Thread starter Erehwon
  • Start date Start date
E

Erehwon

Internet connection has seemed much slower than usual over the past week or
so. One item I happened to check was the Zone Alarm log. What I noted was
that, under the Program Log Viewer, I have a series of entries for "Generic
Host Process for Win32 Services was blocked from accepting a connection from
the internet (192.168.1.1:Port xxxx)" where xxxx is steadily incrementing by
1 every few seconds. From what I could look up, 192.168.1.1 can be
associated with home networks which I don't have. There was also some info
on "black hole servers" that I couldn't follow. Any idea what could be
causing this and whether this activity could be slowing down connection?
Running WinXP SP2 on Dell Dimension 8300 3.0 GHZ P4 and using IE7. Current
on all MS updates. Using Intel(R) PRO/100 VE Network Connection to a shared
T1 line (through my apartment) to connect. No router. Zone Alarm is free
version 7.0.462.
 
From: "Erehwon" <[email protected]>

| Internet connection has seemed much slower than usual over the past week or
| so. One item I happened to check was the Zone Alarm log. What I noted was
| that, under the Program Log Viewer, I have a series of entries for "Generic
| Host Process for Win32 Services was blocked from accepting a connection from
| the internet (192.168.1.1:Port xxxx)" where xxxx is steadily incrementing by
| 1 every few seconds. From what I could look up, 192.168.1.1 can be
| associated with home networks which I don't have. There was also some info
| on "black hole servers" that I couldn't follow. Any idea what could be
| causing this and whether this activity could be slowing down connection?
| Running WinXP SP2 on Dell Dimension 8300 3.0 GHZ P4 and using IE7. Current
| on all MS updates. Using Intel(R) PRO/100 VE Network Connection to a shared
| T1 line (through my apartment) to connect. No router. Zone Alarm is free
| version 7.0.462.
|

Generic Host Process is SVCHOST.exe and is normal.

In a command prompt please type; IPCONFIG

What is your IP address ?
 
David H. Lipman said:
From: "Erehwon" <[email protected]>

| Internet connection has seemed much slower than usual over the past week
or
| so. One item I happened to check was the Zone Alarm log. What I noted
was
| that, under the Program Log Viewer, I have a series of entries for
"Generic
| Host Process for Win32 Services was blocked from accepting a connection
from
| the internet (192.168.1.1:Port xxxx)" where xxxx is steadily
incrementing by
| 1 every few seconds. From what I could look up, 192.168.1.1 can be
| associated with home networks which I don't have. There was also some
info
| on "black hole servers" that I couldn't follow. Any idea what could be
| causing this and whether this activity could be slowing down connection?
| Running WinXP SP2 on Dell Dimension 8300 3.0 GHZ P4 and using IE7.
Current
| on all MS updates. Using Intel(R) PRO/100 VE Network Connection to a
shared
| T1 line (through my apartment) to connect. No router. Zone Alarm is
free
| version 7.0.462.
|

Generic Host Process is SVCHOST.exe and is normal.

In a command prompt please type; IPCONFIG

What is your IP address ?
Click to expand...
Dynamic IP, Current address 10.20.3.224
 
David H. Lipman said:
From: "Erehwon" <[email protected]>


| Dynamic IP, Current address 10.20.3.224
|

Are you using a Router or Router+Modem or other Internet access appliance
?
Click to expand...
No. Cable from wall connects directly to network connection at back of
computer.
 
From: "Erehwon" <[email protected]>


| No. Cable from wall connects directly to network connection at back of
| computer.
|

Well 192.168.1.1 is a non-routable address so it does NOT come from the Internet.

You have some network appliance performing NAT becuase 10.20.3.224 is also a non-routable
Private IP address.

I can only assume whatever device is performing NAT also uses 192.168.1.1
 
[email protected] said:
From: "Erehwon" <[email protected]>


| No. Cable from wall connects directly to network connection at back of
| computer.
|

Well 192.168.1.1 is a non-routable address so it does NOT come from the Internet.

You have some network appliance performing NAT becuase 10.20.3.224 is also a non-routable
Private IP address.

I can only assume whatever device is performing NAT also uses 192.168.1.1
Click to expand...

I don't know how "shared T1" works.
A quick google shows that it *is* "routed" from the provider, before end
user plugs in.
But of course 192.168.1.1 would generally be the first computer on that
route. As a matter of fact, that's THIS computers IP behind my router
with 3 boxes attached, but of course not my real IP to the world.

Any chance Zone Alarm itself adds a "virtual" router IP (I don't use it,
so don't know)?

MM
 
Sunny said:
???
216.176.150.135 is shown as where you are posting through
Click to expand...
Correct. 216.176.150.135 belongs to NETNITCO who provides my internet
connection. 10.20.3.224 is what shows up on ipconfig.exe so I assume that's
a connection to their router or server ?? I'm not familiar with the
hardware or how the connection works but I know there's a closet in each
apartment building with equipment to connect each of the 8 apartments in
that building. I believe there's also an equipment room in the main office
that connects the 30 or so buildings in the complex to the line(s) NETNITCO
provides. I said dynamic IP because the TCP/IP properties for my connection
has "Obtain an IP address automatically" checked rather than "Use the
following IP address ..." Perhaps that was an incorrect use of the term
"Dynamic IP address" on my part. In the mean time, Zone Alarm is still
continuing to block svchost.exe from accepting connections from 192.168.1.1
this morning, ports 1674 to 1949 over just the past 50 minutes.
 
From: "Erehwon" <[email protected]>


| Correct. 216.176.150.135 belongs to NETNITCO who provides my internet
| connection. 10.20.3.224 is what shows up on ipconfig.exe so I assume that's
| a connection to their router or server ?? I'm not familiar with the
| hardware or how the connection works but I know there's a closet in each
| apartment building with equipment to connect each of the 8 apartments in
| that building. I believe there's also an equipment room in the main office
| that connects the 30 or so buildings in the complex to the line(s) NETNITCO
| provides. I said dynamic IP because the TCP/IP properties for my connection
| has "Obtain an IP address automatically" checked rather than "Use the
| following IP address ..." Perhaps that was an incorrect use of the term
| "Dynamic IP address" on my part. In the mean time, Zone Alarm is still
| continuing to block svchost.exe from accepting connections from 192.168.1.1
| this morning, ports 1674 to 1949 over just the past 50 minutes.
|

Just like a store with a window who have "window shoppers", just ignore it.
 
Back
Top