--- "Ilya A. Kovalenko" <[EMAIL PROTECTED]> wrote: > PM> My firewall is pretty tight. I block all incoming by default and let out > only certain > PM> destination ports. I'm currently filtering on external interface only. > > PM> Now I decided to do a check on all outgoing traffic > PM> (filtering out of course the allowed ports) > PM> and I made an interesting discovery. > > PM> I am on dial-up (PPP) with a Canadian ISP (Sympatico) and I > PM> am sending out regular replies to > PM> port 135. I figured this is due to PPP tunneling. In 15 > PM> minutes I was replying to about a > PM> dozen different IP addresses but they all resolve back to my ISPs servers > (or clients?): > > These hosts, probably, infected w/ "Lovesan" (aka "MS-blast") virus. It > scans networks for vulnerable Windows boxes to infect. > > but you, should see it as incoming requests, than, your host replys.
I do get, like everyone else, incoming requests due to the reason you give but this is the only port my firewall is responding to and I have no idea why except the hypothesis that it is due to some PPP tunneling being done by my ISP. Furthermore, I went to the Shields Up! site at https://grc.com/x/ne.dll?bh0bkyd2 and it scanned my IP and did not report *any* ports open. This is what I should expect. Peter ______________________________________________________________________ Post your free ad now! http://personals.yahoo.ca
