new firewall alerts

Discussion in 'Windows XP Security' started by Guest, May 22, 2009.

  1. Guest

    Guest Guest

    Hi I am on a laptop running XP SP3, and have recently been getting repeated
    Security Alerts from my Zone Alarm firewall. I was at the time traveling
    and thought that the insecure hotel networks might have been the problem,
    but I am now back home - using my home wireless network which connects to
    the internet via a router - and I am still getting these alerts.

    The alerts inform me that ZA has blocked incoming access to my PC and have
    the following text:

    1. The firewall has blocked local network access to you computer [TCP Port
    2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]

    2. same but with [TCP Port 2176]

    3. same but with [TCP Port 2177]

    What if anything should I do about this? I know I did not get these alerts
    before I set out on this trip. I've checked for malware and for viruses and
    am apparently clean.

    I have no idea what TCP Port 2176, 2177, or 2178 represent.

    Jeff
     
    Guest, May 22, 2009
    #1
    1. Advertisements

  2. Guest

    Mark Brown Guest

    Hello,

    First an explanation of the message you are receiving...
    >> The firewall has blocked local network access to you computer [TCP Port
    >> 2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]


    192.168.x.x is a private network block and in this case most likely is your
    own router (192.168.1.1).
    It is sending a SYN packet (TCP Flags: S) to try to open a connection using
    the router's temporary port range incrementally (port 2175, 2176, 2177,
    ect).
    That SYN packet to open a connection is going to your computer's port
    TCP/2869. This port has been known to be used by Microsoft Windows Universal
    Plug and Play (Automatic configuration of network devices, including
    computers, routers, and firewall settings).

    I have no idea what really changed in your configuration that would allow
    you to see such messages but this seems to be either a configuration error
    of ZoneAlarm or something turned on Universal Plug and Play in your computer
    and/or router recently.



    <> wrote in message
    news:...
    > Hi I am on a laptop running XP SP3, and have recently been getting
    > repeated Security Alerts from my Zone Alarm firewall. I was at the time
    > traveling and thought that the insecure hotel networks might have been the
    > problem, but I am now back home - using my home wireless network which
    > connects to the internet via a router - and I am still getting these
    > alerts.
    >
    > The alerts inform me that ZA has blocked incoming access to my PC and have
    > the following text:
    >
    > 1. The firewall has blocked local network access to you computer [TCP Port
    > 2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]
    >
    > 2. same but with [TCP Port 2176]
    >
    > 3. same but with [TCP Port 2177]
    >
    > What if anything should I do about this? I know I did not get these
    > alerts before I set out on this trip. I've checked for malware and for
    > viruses and am apparently clean.
    >
    > I have no idea what TCP Port 2176, 2177, or 2178 represent.
    >
    > Jeff
    >
     
    Mark Brown, May 23, 2009
    #2
    1. Advertisements

  3. Guest

    Guest Guest

    Thank you very much Mark. That is very helpful.

    Is turning on Universal Plug and Play a good idea? Should I turn it off and
    if so how?

    Not sure what the change was but I did have recent Zone Alarm and Windows XP
    updates, so either could be at fault.

    Incidentally, subsequent to your kind response I checked the Zone Alarm
    settings, and I see that I do have 192.168.1.1 in the trusted zone as "DHCP
    and DNS servers". So this is weird and I will ask the ZA forum about it.

    Jeff


    "Mark Brown" <> wrote in message
    news:Oo%...
    > Hello,
    >
    > First an explanation of the message you are receiving...
    >>> The firewall has blocked local network access to you computer [TCP Port
    >>> 2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]

    >
    > 192.168.x.x is a private network block and in this case most likely is
    > your own router (192.168.1.1).
    > It is sending a SYN packet (TCP Flags: S) to try to open a connection
    > using the router's temporary port range incrementally (port 2175, 2176,
    > 2177, ect).
    > That SYN packet to open a connection is going to your computer's port
    > TCP/2869. This port has been known to be used by Microsoft Windows
    > Universal Plug and Play (Automatic configuration of network devices,
    > including computers, routers, and firewall settings).
    >
    > I have no idea what really changed in your configuration that would allow
    > you to see such messages but this seems to be either a configuration error
    > of ZoneAlarm or something turned on Universal Plug and Play in your
    > computer and/or router recently.
    >
    >
    >
    > <> wrote in message
    > news:...
    >> Hi I am on a laptop running XP SP3, and have recently been getting
    >> repeated Security Alerts from my Zone Alarm firewall. I was at the time
    >> traveling and thought that the insecure hotel networks might have been
    >> the problem, but I am now back home - using my home wireless network
    >> which connects to the internet via a router - and I am still getting
    >> these alerts.
    >>
    >> The alerts inform me that ZA has blocked incoming access to my PC and
    >> have the following text:
    >>
    >> 1. The firewall has blocked local network access to you computer [TCP
    >> Port 2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]
    >>
    >> 2. same but with [TCP Port 2176]
    >>
    >> 3. same but with [TCP Port 2177]
    >>
    >> What if anything should I do about this? I know I did not get these
    >> alerts before I set out on this trip. I've checked for malware and for
    >> viruses and am apparently clean.
    >>
    >> I have no idea what TCP Port 2176, 2177, or 2178 represent.
    >>
    >> Jeff
    >>
     
    Guest, May 23, 2009
    #3
  4. Guest

    Guest Guest

    Could my having "upgraded" to I.E.8 recently and then removed it and
    manually installed I.E. 7 be the cause of the new alerts?

    Jeff

    "Mark Brown" <> wrote in message
    news:Oo%...
    > Hello,
    >
    > First an explanation of the message you are receiving...
    >>> The firewall has blocked local network access to you computer [TCP Port
    >>> 2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]

    >
    > 192.168.x.x is a private network block and in this case most likely is
    > your own router (192.168.1.1).
    > It is sending a SYN packet (TCP Flags: S) to try to open a connection
    > using the router's temporary port range incrementally (port 2175, 2176,
    > 2177, ect).
    > That SYN packet to open a connection is going to your computer's port
    > TCP/2869. This port has been known to be used by Microsoft Windows
    > Universal Plug and Play (Automatic configuration of network devices,
    > including computers, routers, and firewall settings).
    >
    > I have no idea what really changed in your configuration that would allow
    > you to see such messages but this seems to be either a configuration error
    > of ZoneAlarm or something turned on Universal Plug and Play in your
    > computer and/or router recently.
    >
    >
    >
    > <> wrote in message
    > news:...
    >> Hi I am on a laptop running XP SP3, and have recently been getting
    >> repeated Security Alerts from my Zone Alarm firewall. I was at the time
    >> traveling and thought that the insecure hotel networks might have been
    >> the problem, but I am now back home - using my home wireless network
    >> which connects to the internet via a router - and I am still getting
    >> these alerts.
    >>
    >> The alerts inform me that ZA has blocked incoming access to my PC and
    >> have the following text:
    >>
    >> 1. The firewall has blocked local network access to you computer [TCP
    >> Port 2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]
    >>
    >> 2. same but with [TCP Port 2176]
    >>
    >> 3. same but with [TCP Port 2177]
    >>
    >> What if anything should I do about this? I know I did not get these
    >> alerts before I set out on this trip. I've checked for malware and for
    >> viruses and am apparently clean.
    >>
    >> I have no idea what TCP Port 2176, 2177, or 2178 represent.
    >>
    >> Jeff
    >>
     
    Guest, May 23, 2009
    #4
    1. Advertisements

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Markk H.
    Replies:
    2
    Views:
    388
  2. firewall
    Replies:
    1
    Views:
    473
    Nicholas
    Sep 15, 2003
  3. Torgeir Bakken \(MVP\)

    Re: Firewall Disabled yet Alerts still showing in Event Viewer

    Torgeir Bakken \(MVP\), Sep 10, 2004, in forum: Windows XP Security
    Replies:
    0
    Views:
    228
    Torgeir Bakken \(MVP\)
    Sep 10, 2004
  4. martin

    Windows Firewall Off Alerts

    martin, Jun 7, 2006, in forum: Windows XP Security
    Replies:
    2
    Views:
    228
    martin
    Jun 8, 2006
  5. Dugg80

    Incessant firewall alerts!

    Dugg80, Oct 30, 2009, in forum: Windows XP Security
    Replies:
    1
    Views:
    392
    squirltok
    Nov 2, 2009
Loading...

Share This Page