An Intrusion Attempt From The Same IP Address Was Blocked

Norton Security | Norton Internet Security
1

Hi,

 

I was looking through my Norton history and i keep getting intrusion attempts from the same ip address, when i check the details it says that its a portscan and its been blocked no action required. Could someone please tell me what is happening.

 

Thanks.

2

Floating Red

 

Thanks for the quick reply, Port 53 its been doing this since July 5th no entries before that, i'm always very carefull about what sites to visit how could this have happened.

3

Hi, GasCan,

 

You're welcome!

 

What does it say in the Attacking Computer; what I.P. Address is there?  And is it the same as the Destination Address?

 

4

The attacking computer is the same as the source address, except the attacking computer has ", 53" after it. Will i list the IP address.

Message Edited by GasCan on 08-31-2009 06:57 AM
5

Hi,

 

What about the Destination Address?  Is that the same as the Attacking Computer?

 

 

6

Sorry Floating Red miss read your question no the destination address (keeps changing) is different from the attacking computer (stays the same). Could this be a false positve. I was looking around could this be DNS traffic.

Message Edited by GasCan on 08-31-2009 07:35 AM
7

Hi GasCan,

 

As long as the Security History shows "Intrusion Attempt is Blocked" and "No Action required", you don't have to worry about the protection. This simply means that NOrton program is doing it's job of blocking an unauthorized access to your computer from that source IP Address, probably an hacker or malicious Web Site trying to gain access to your computer. This may be happening in many other computers at the same time, and those who are having efficient security product like NIS 2009, will be protected. Norton 2009 products have application intelligence baked in, allowing it to make security decisions so that you don’t have to. The Smart Firewall intelligently makes security decisions for you—allowing you to use your computer without you needing to be a security expert (This is one of those decisions, blocking an intrusion attempt to your computer).

 

Yogesh

Message Edited by yogesh_mohan on 08-31-2009 08:09 PM
8

Thanks Yogesh Mohan for the info

 

I know my computer is safe as Norton is working as it should, could it be an increase in DNS traffic that is triggering the warning. Is there a way of blocking the ip address.

 

Thanks.

9

That entry in your Security log indicates that Norton is blocking the unauthorized access from that IP Address. I don’t see any necessary to block it again, or you can decide whether it is required when Norton is already blocking all it’s intrusion attempts.

10

Solved the problem its my DNS server traffic, happens alot on Facebook and MySpace or when the DNS Server is overloaded with queries. Norton thinks im being attacked when the port is open to long. Last post is what is happening to me.

 

Thanks Floating Red, Yogesh Mohan for the help.

Message Edited by GasCan on 08-31-2009 08:04 AM
11
GasCan wrote:

Solved the problem its my DNS server traffic, happens alot on Facebook and MySpace or when the DNS Server is overloaded with queries. Norton thinks im being attacked when the port is open to long.

Hi,

 

Yep; I was just about to Post that it looks like it is a F.P., and here's the proof I was correct.

 

Always glad you help; you're welcome!

 

12

Hi,

 

I was looking through my Norton history and i keep getting intrusion attempts from the same ip address, when i check the details it says that its a portscan and its been blocked no action required. Could someone please tell me what is happening.

 

Thanks.