Symantec Intrusion Prevention Signatures: AutoBlock

and let me clarify- it might be the same address 1-3 times attempting the same port, then the same address attempting another port. I don't think I have ever seen the same address at the same port  more than 3 times in the same few minutes. Now the same address at the same port maybe several times over the course of a couple of days, but not just continuous, like I said more than 3 times. It seems like it gives up (hopefully not getting in) and moves to another port. This is why I need to not view the logs. :)

I don't understand them and just get freaked


NY1986 wrote:

and let me clarify- it might be the same address 1-3 times attempting the same port, then the same address attempting another port. I don't think I have ever seen the same address at the same port  more than 3 times in the same few minutes. Now the same address at the same port maybe several times over the course of a couple of days, but not just continuous, like I said more than 3 times. It seems like it gives up (hopefully not getting in) and moves to another port. This is why I need to not view the logs. :)

I don't understand them and just get freaked


 

If it did get in, it would most-like smack a Virus on your computer.

 

There is no need to worry; un-used Port-blocking will not allow an Attacking computer in.  :)


reese_anschultz wrote:

I'm not sure why this would question the effectiveness of AutoBlock.


 

What i mean by this is that maybe AutoBlock will not even Block an Attacking computer for even the Default of 30minutes when it is set to 48hours.

 

If you see it in the Auto-Block list, it’s blocked. I have asked somebody to try to reproduce your issue of the timmer going away earlier than expected.


reese_anschultz wrote:
If you see it in the Auto-Block list, it's blocked.

 

I know this.

 

Any further information regard to this?

Not yet, sorry.

3 Likes

Pls provide the version of the product and the operating system that you are using. I’ve not heard of this problem before but the code is different for those two factors and this will help to understand the problem better.