Although, I briefly stated why earlier, I'll try to give a better understanding as to
/why/ this /can/ happen.
If you are on dialup, you dial in and get an IP number assigned to your computer.
lets say you dial up on Monday and you get IP 123.123.123.123 and Joe Blow down the
street dials in on Monday and gets 123.123.123.111 IP assigned to him. Now, Joe Blow
is using Gnutilla, or some P2P that uses said port. So, he tell the world that port
6346 is open and everyone should come to that port on his IP and get free files.
Well, you both disconnect Monday night and reconnect Tuesday. On Tuesday, you get
assigned IP 123.123.123.111 (Joe's old IP). However, the world does not know that you
are not running the P2P, and do not have free files on your computer. The world still
thinks your computer is Joe's computer. So, the world continues to access port 6346
on IP 123.123.123.111. However, ZoneAlarm has not been told to allow anything in on
port 6346, so it blocks that port. Even if zonealarm was not installed, that port on
your computer should be closed by default, since you are not running P2P.
Joe dials back in on Tuesday night and gets a new IP (say 123.123.123.222) and starts
the cycle all over again once he uses his P2P program. (Hopefully on Wednesday you
won't get his old IP address again ;)
If you are on cable modem you have what is called a dynamic IP. This dynamic IP has a
'lease' time. after that lease time expires you will get a new IP. Usually this is
the same IP that gets reassigned to you each time, but it is not /always/ the case.
Some times you will get a new IP leased to you. The same concept applies to cable
modems, except instead of 'dialing in' you would 'renew your lease'.
Anyway, I know it is frustrating. I don't know how long it takes for the world to
'realize' that you are not Joe, and stops sending probes to your 6346 port. It has
happened to me on occasion where I was flooded with probes to P2P ports, in which
cases I email the [EMAIL PROTECTED] (where ISP is the ISP of the source of the probe),
and/or you could email [EMAIL PROTECTED] Both times I waited 2 days before sending
an email, just to see if it would stop, which it did not.
Hope that helps,
-John
: -----Original Message-----
: From: Thomas Madhavan [mailto:[EMAIL PROTECTED]]
: Sent: Wednesday, April 17, 2002 2:27 PM
: To: [EMAIL PROTECTED]
: Subject: Re: Zonealarm log - what is this?
:
:
: Thanks a lot for all your replies : Admittedly I should have checked the
: ZoneAlarm readme and port listings, but why would a P2P port be
: open? I have
: no file sharing programs running (do they scan in the
: background?), or is it
: just other client servers scanning my computer for ports to connect to? If
: so are there any legal implements about scanning in this way?
:
: Thanks for the ZoneLog information, I'll check it out.
:
: Regards,
: Thomas Madhavan
:
