Firewall logs

[Nitrox]

I was just having a browse round the Trend Micro Pc-cillin software on my PC and noticed that I could view personal firewall logs. Am I right in thinking that all the entries listed in here are attempts by others at hacking into my PC ? And if so, is there anything I can do about it ? e.g. it lists such things as source and destination IP address and port; could this info be used to identify/locate those concerned; (not that I'd bother) Would it be of any interest to anyone else who is bothered (are there such people) ?? It also gives a description against each entry of 'cloaking'. What does this mean ?

[Matth]

Do they mean it stealthed the port?

As for reporting, it may or may not be worth bothering, though if it's an NTL customer (on cable), take it here http://www.ntlworld.com/netreport/

Reporting dialup users is hardly worth the bother, but since NTL cable customers tend to keep the same IP for long periods, the virus or aggressive prober is likely to stay there.

The probes may also be P2P software looking for a host, though that's usually only troublesome AFTER an IP address change, if the previous holder of the address was running a P2P share.

Other stuff hitting the firewall is just background noise, or backscatter from address spoofing - if some scummy little DDOS trojan elsewhere spoofed your source address, the reply packet will strike your firewall - if respected sources seem to be probing YOU, that's the most likely.

[rdhw]

Originally Posted by Nitrox

is there anything I can do about it?

The best thing to do with a firewall log is to ignore it completely, unless you are trying to debug why your firewall settings are preventing something working which you want to work. Many firewall log entries arise from harmless side-effects of living on the internet, and you would cause unjustified trouble if you tried to follow them up. The few that represent genuine malicious probes (if you could distinguish which they were, which is non-trivial) might be worth noting, but basically most people have better things to do with their life. If your firewall does its job, you are best advised to just let it get on with it: after all that's what you paid for it to do.

It would be unproductive if end-users flooded their ISPs' abuse reporting channels with indiscriminate firewall logs. If a probe was blocked by your firewall, then it might not have caused you sufficient grief to justify you reporting it as abuse.

[Matth]

Candidates for reporting tend to be:
1. Repeated hits on the same port, from the same address
2. A spread of ports, from one address, particularly with a pattern of those ports

I've been using this firewall for so long, I have a gut feeling as to what is "hostile" probing, and what is just junk.

It may be better to send log reports to Dshield, as by collating reports, a clearer picture of the real troublemakers emerges.
http://www.dshield.org
It's also worth looking at the ports flagged there, as that shows what is rattling around.

The "noise level" is worse than usual...
Port 2745 has been getting quite a hammering
5000 is on the increase
5554 and 9898 are ones I haven't seen taking hit's before - there's GOT to be another couple of worm variants out there - that's what most of it is these days, worms trying to find holes.

NTL need to intensify their quarantine policy, and SOONER rather than later - they shut the door after the horse had bolted, when it came to Blaster, but at least the port blocking an quarantine stopped re-infection.

Mind you, most of the current ports are dynamic, and blocking those could interfere with normal traffic.

All it needs, is a few trap systems in the address range, hit two of them in close succession and you're in trouble.