new firewall alerts

[Guest]

Hi I am on a laptop running XP SP3, and have recently been getting repeated
Security Alerts from my Zone Alarm firewall. I was at the time traveling
and thought that the insecure hotel networks might have been the problem,
but I am now back home - using my home wireless network which connects to
the internet via a router - and I am still getting these alerts.

The alerts inform me that ZA has blocked incoming access to my PC and have
the following text:

1. The firewall has blocked local network access to you computer [TCP Port
2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]

2. same but with [TCP Port 2176]

3. same but with [TCP Port 2177]

What if anything should I do about this? I know I did not get these alerts
before I set out on this trip. I've checked for malware and for viruses and
am apparently clean.

I have no idea what TCP Port 2176, 2177, or 2178 represent.

Jeff

 

[Mark Brown]

Hello,

First an explanation of the message you are receiving...

The firewall has blocked local network access to you computer [TCP Port
2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]

192.168.x.x is a private network block and in this case most likely is your
own router (192.168.1.1).
It is sending a SYN packet (TCP Flags: S) to try to open a connection using
the router's temporary port range incrementally (port 2175, 2176, 2177,
ect).
That SYN packet to open a connection is going to your computer's port
TCP/2869. This port has been known to be used by Microsoft Windows Universal
Plug and Play (Automatic configuration of network devices, including
computers, routers, and firewall settings).

I have no idea what really changed in your configuration that would allow
you to see such messages but this seems to be either a configuration error
of ZoneAlarm or something turned on Universal Plug and Play in your computer
and/or router recently.

Hi I am on a laptop running XP SP3, and have recently been getting
repeated Security Alerts from my Zone Alarm firewall. I was at the time
traveling and thought that the insecure hotel networks might have been the
problem, but I am now back home - using my home wireless network which
connects to the internet via a router - and I am still getting these
alerts.

The alerts inform me that ZA has blocked incoming access to my PC and have
the following text:

1. The firewall has blocked local network access to you computer [TCP Port
2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]

2. same but with [TCP Port 2176]

3. same but with [TCP Port 2177]

What if anything should I do about this? I know I did not get these
alerts before I set out on this trip. I've checked for malware and for
viruses and am apparently clean.

I have no idea what TCP Port 2176, 2177, or 2178 represent.

Jeff

 

[Guest]

Thank you very much Mark. That is very helpful.

Is turning on Universal Plug and Play a good idea? Should I turn it off and
if so how?

Not sure what the change was but I did have recent Zone Alarm and Windows XP
updates, so either could be at fault.

Incidentally, subsequent to your kind response I checked the Zone Alarm
settings, and I see that I do have 192.168.1.1 in the trusted zone as "DHCP
and DNS servers". So this is weird and I will ask the ZA forum about it.

Jeff

Hello,

First an explanation of the message you are receiving...

The firewall has blocked local network access to you computer [TCP Port
2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]

192.168.x.x is a private network block and in this case most likely is
your own router (192.168.1.1).
It is sending a SYN packet (TCP Flags: S) to try to open a connection
using the router's temporary port range incrementally (port 2175, 2176,
2177, ect).
That SYN packet to open a connection is going to your computer's port
TCP/2869. This port has been known to be used by Microsoft Windows
Universal Plug and Play (Automatic configuration of network devices,
including computers, routers, and firewall settings).

I have no idea what really changed in your configuration that would allow
you to see such messages but this seems to be either a configuration error
of ZoneAlarm or something turned on Universal Plug and Play in your
computer and/or router recently.

Hi I am on a laptop running XP SP3, and have recently been getting
repeated Security Alerts from my Zone Alarm firewall. I was at the time
traveling and thought that the insecure hotel networks might have been
the problem, but I am now back home - using my home wireless network
which connects to the internet via a router - and I am still getting
these alerts.

The alerts inform me that ZA has blocked incoming access to my PC and
have the following text:

1. The firewall has blocked local network access to you computer [TCP
Port 2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]

2. same but with [TCP Port 2176]

3. same but with [TCP Port 2177]

What if anything should I do about this? I know I did not get these
alerts before I set out on this trip. I've checked for malware and for
viruses and am apparently clean.

I have no idea what TCP Port 2176, 2177, or 2178 represent.

Jeff

 

[Guest]

Could my having "upgraded" to I.E.8 recently and then removed it and
manually installed I.E. 7 be the cause of the new alerts?

Jeff

Hello,

First an explanation of the message you are receiving...

The firewall has blocked local network access to you computer [TCP Port
2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]

192.168.x.x is a private network block and in this case most likely is
your own router (192.168.1.1).
It is sending a SYN packet (TCP Flags: S) to try to open a connection
using the router's temporary port range incrementally (port 2175, 2176,
2177, ect).
That SYN packet to open a connection is going to your computer's port
TCP/2869. This port has been known to be used by Microsoft Windows
Universal Plug and Play (Automatic configuration of network devices,
including computers, routers, and firewall settings).

I have no idea what really changed in your configuration that would allow
you to see such messages but this seems to be either a configuration error
of ZoneAlarm or something turned on Universal Plug and Play in your
computer and/or router recently.

Hi I am on a laptop running XP SP3, and have recently been getting
repeated Security Alerts from my Zone Alarm firewall. I was at the time
traveling and thought that the insecure hotel networks might have been
the problem, but I am now back home - using my home wireless network
which connects to the internet via a router - and I am still getting
these alerts.

The alerts inform me that ZA has blocked incoming access to my PC and
have the following text:

1. The firewall has blocked local network access to you computer [TCP
Port 2869] from 192.168.1.1 [192.168.1.1][TCP Port 2175]{TCP Flags: S]

2. same but with [TCP Port 2176]

3. same but with [TCP Port 2177]

What if anything should I do about this? I know I did not get these
alerts before I set out on this trip. I've checked for malware and for
viruses and am apparently clean.

I have no idea what TCP Port 2176, 2177, or 2178 represent.

Jeff