Zone Alarm Log Question

[Erehwon]

Internet connection has seemed much slower than usual over the past week or
so. One item I happened to check was the Zone Alarm log. What I noted was
that, under the Program Log Viewer, I have a series of entries for "Generic
Host Process for Win32 Services was blocked from accepting a connection from
the internet (192.168.1.1ort xxxx)" where xxxx is steadily incrementing by
1 every few seconds. From what I could look up, 192.168.1.1 can be
associated with home networks which I don't have. There was also some info
on "black hole servers" that I couldn't follow. Any idea what could be
causing this and whether this activity could be slowing down connection?
Running WinXP SP2 on Dell Dimension 8300 3.0 GHZ P4 and using IE7. Current
on all MS updates. Using Intel(R) PRO/100 VE Network Connection to a shared
T1 line (through my apartment) to connect. No router. Zone Alarm is free
version 7.0.462.

 

[David H. Lipman]

From: "Erehwon" <[email protected]>

| Internet connection has seemed much slower than usual over the past week or
| so. One item I happened to check was the Zone Alarm log. What I noted was
| that, under the Program Log Viewer, I have a series of entries for "Generic
| Host Process for Win32 Services was blocked from accepting a connection from
| the internet (192.168.1.1ort xxxx)" where xxxx is steadily incrementing by
| 1 every few seconds. From what I could look up, 192.168.1.1 can be
| associated with home networks which I don't have. There was also some info
| on "black hole servers" that I couldn't follow. Any idea what could be
| causing this and whether this activity could be slowing down connection?
| Running WinXP SP2 on Dell Dimension 8300 3.0 GHZ P4 and using IE7. Current
| on all MS updates. Using Intel(R) PRO/100 VE Network Connection to a shared
| T1 line (through my apartment) to connect. No router. Zone Alarm is free
| version 7.0.462.
|

Generic Host Process is SVCHOST.exe and is normal.

In a command prompt please type; IPCONFIG

What is your IP address ?

 

[Erehwon]

From: "Erehwon" <[email protected]>

| Internet connection has seemed much slower than usual over the past week
or
| so. One item I happened to check was the Zone Alarm log. What I noted
was
| that, under the Program Log Viewer, I have a series of entries for
"Generic
| Host Process for Win32 Services was blocked from accepting a connection
from
| the internet (192.168.1.1ort xxxx)" where xxxx is steadily
incrementing by
| 1 every few seconds. From what I could look up, 192.168.1.1 can be
| associated with home networks which I don't have. There was also some
info
| on "black hole servers" that I couldn't follow. Any idea what could be
| causing this and whether this activity could be slowing down connection?
| Running WinXP SP2 on Dell Dimension 8300 3.0 GHZ P4 and using IE7.
Current
| on all MS updates. Using Intel(R) PRO/100 VE Network Connection to a
shared
| T1 line (through my apartment) to connect. No router. Zone Alarm is
free
| version 7.0.462.
|

Generic Host Process is SVCHOST.exe and is normal.

In a command prompt please type; IPCONFIG

What is your IP address ?

Dynamic IP, Current address 10.20.3.224

 

[David H. Lipman]

From: "Erehwon" <[email protected]>


| Dynamic IP, Current address 10.20.3.224
|

Are you using a Router or Router+Modem or other Internet access appliance ?

 

[Erehwon]

From: "Erehwon" <[email protected]>


| Dynamic IP, Current address 10.20.3.224
|

Are you using a Router or Router+Modem or other Internet access appliance
?

No. Cable from wall connects directly to network connection at back of
computer.

 

[David H. Lipman]

From: "Erehwon" <[email protected]>


| No. Cable from wall connects directly to network connection at back of
| computer.
|

Well 192.168.1.1 is a non-routable address so it does NOT come from the Internet.

You have some network appliance performing NAT becuase 10.20.3.224 is also a non-routable
Private IP address.

I can only assume whatever device is performing NAT also uses 192.168.1.1

 

[MoiMoi]

Dynamic IP, Current address 10.20.3.224

IPConfig.exe shows that, or you just know that's the dynamic IP assigned
to you?

MM

 

[MoiMoi]

From: "Erehwon" <[email protected]>


| No. Cable from wall connects directly to network connection at back of
| computer.
|

Well 192.168.1.1 is a non-routable address so it does NOT come from the Internet.

You have some network appliance performing NAT becuase 10.20.3.224 is also a non-routable
Private IP address.

I can only assume whatever device is performing NAT also uses 192.168.1.1

I don't know how "shared T1" works.
A quick google shows that it *is* "routed" from the provider, before end
user plugs in.
But of course 192.168.1.1 would generally be the first computer on that
route. As a matter of fact, that's THIS computers IP behind my router
with 3 boxes attached, but of course not my real IP to the world.

Any chance Zone Alarm itself adds a "virtual" router IP (I don't use it,
so don't know)?

MM

 

[Sunny]

Dynamic IP, Current address 10.20.3.224

???
216.176.150.135 is shown as where you are posting through

 

[Erehwon]

???
216.176.150.135 is shown as where you are posting through

Correct. 216.176.150.135 belongs to NETNITCO who provides my internet
connection. 10.20.3.224 is what shows up on ipconfig.exe so I assume that's
a connection to their router or server ?? I'm not familiar with the
hardware or how the connection works but I know there's a closet in each
apartment building with equipment to connect each of the 8 apartments in
that building. I believe there's also an equipment room in the main office
that connects the 30 or so buildings in the complex to the line(s) NETNITCO
provides. I said dynamic IP because the TCP/IP properties for my connection
has "Obtain an IP address automatically" checked rather than "Use the
following IP address ..." Perhaps that was an incorrect use of the term
"Dynamic IP address" on my part. In the mean time, Zone Alarm is still
continuing to block svchost.exe from accepting connections from 192.168.1.1
this morning, ports 1674 to 1949 over just the past 50 minutes.

 

[David H. Lipman]

From: "Erehwon" <[email protected]>


| Correct. 216.176.150.135 belongs to NETNITCO who provides my internet
| connection. 10.20.3.224 is what shows up on ipconfig.exe so I assume that's
| a connection to their router or server ?? I'm not familiar with the
| hardware or how the connection works but I know there's a closet in each
| apartment building with equipment to connect each of the 8 apartments in
| that building. I believe there's also an equipment room in the main office
| that connects the 30 or so buildings in the complex to the line(s) NETNITCO
| provides. I said dynamic IP because the TCP/IP properties for my connection
| has "Obtain an IP address automatically" checked rather than "Use the
| following IP address ..." Perhaps that was an incorrect use of the term
| "Dynamic IP address" on my part. In the mean time, Zone Alarm is still
| continuing to block svchost.exe from accepting connections from 192.168.1.1
| this morning, ports 1674 to 1949 over just the past 50 minutes.
|

Just like a store with a window who have "window shoppers", just ignore it.