Constant "attacks" using the Gnutella port
 

Everytime I start my computer ZoneAlarm starts immediately to receive "attacks" from four
different IP-Addresses all using the Gnutella port 6346. I have installed LimeWire and Morpheus
but these aren`t running when those "attacks" appear. Those attacks go on all the time when my
computer is running appearing about 2 times in a minute. Any ideas what might be causing this ?

I think you closed Limewire or Mopheus a short time ago... your IP is still in the hostcaches and so some other clients try to connect but your firewall blocks them, because your client isn´t running anymore.

If this is annoying to you, you should disconnect and connect again... now your IP changed (if you don´t have a fixed one) and the problem is gone.

Morgwen

Morgwen: Good guess but I think that`s not the issue here because I haven`t been using any Gnutella applications in past 5 days and I have dynamic IP-Address.

You should be happy, you must live in a area where everyone uses Gnutella, all IPs of your ISP have been using Gnutella lately.
Or it's more like your "dynamic" IP isn't - you should write it down and see if it really changes.
Ignore the hits, change zonealarm's settings to ignore it, or get a real firewall that doesn't pester you to get you to BUY the "pro" version.
Why do you think it pesters you so much? People have been complaining about this program for months now.

Plus, you can shut of the annoying popups of zonealarm.

Disturbing
 

Hi all, Ive recently installed XoloX version 112 with the 115 update. I have been using a program called COMMVIEW to see what resources have been used where and when, when running client software. My findings are very disturbing. If you would like to see what I mean, then please take a look at the ip status read out 5 minutes after switching Xolox on, and 5 minutes after switching Xolox off. (both pages were made when nothing was being downloaded by Xolox)
You can find them here:
http://www.mjholdings.com/xolox.HTM (5 mins after on)
http://www.mjholdings.com/xolox turned off.HTM (5 mins after off)

We also performed these tests on Kazaa, and again, you can follow the link below to see the stats we got.
http://www.mjholdings.com/kazaa_5sec...fter_start.HTM

So what have I learned, well firstly, no client software should have access to Port 137, which is used by netbios. And when I dont have any files in my shared folder, why are these people trying to connect to my computer through Xolox??
1ST IP ADDY = WARSZAWA
2ND IP ADDY = NORTH DAKOTA STATE UNIVERSITY
3RD IP ADDY = WARSZAWA
4TH IP ADDY = USA / MEXICO BORDER
5TH IP ADDY = SOMEWHERE NEAR DES MOINES USA
6TH IP ADDY = SOMEWHERE NEAR AYLESBERY VALE ENGLAND
7TH IP ADDY = SANTO DOMINGO
8TH IP ADDY = BALTIMORE USA
The above details are from the Xolox 5 minutes after off page., but still people are trying to connect to our PC. The IP address's have been traced back to the people that are connecting to me here, and sending me data packets, also this is where they reside. Bouncy bouncy, hmmmmm. Thanks Xolox, but no thanks.

When you connect to the network your client passes your ip to other clients so they can connect to your client. When the other clients receive your ip they store it. When they need another connection they attempt to connect to one of the ips they have stored. They have no way of knowing if you have shut off your client until they try to connect. That is why you see people connecting to your computer after you have shutdown your client.

As for the connection on port 137, I am guessing that may just be an error with your monitoring software.


Corrected link from above: http://www.mjholdings.com/xolox turned off.HTM (5 mins after off)

Hi,
but my worry is the fact that I do not have any kind of files in my stored folder as I have not d/l'ed anything. And my network status is going like the clappers, my modem lights are going 10 to the dozen, as if I am downloading something at 150kbps. I really advise you do the same check with Commview software, I think you'll be rather surprised. As for the port 137, it isnt an error in my monitoring software at all, what a stab in the dark! I have had six other people try this on their systems with a range of different software, each and every one of them recieving some kind of a hit against port 137, and I forgot to mention that I have had several bounces from kiddy porn servers whilst this software was running, and NO, that is not normal at all. I shall be finding out from the our ISP what exactly is going on with the porn bounces, and shall post as soon as I know myself. Keep ur eyes open people.
PS: thnx for the corrected link :-)

This is normal behavior for a client. It sends/receives MANY small packets. This is how the network keeps running. Since you say you are not sharing any files and are not downloading any files, they are just basic connection packets ( pings pongs ) and packets related to searches.

These are just queries. As long as you do not share and/or download any child porn, you should just ignore it. No files are actually transferred THROUGH clients. If someone wants to download a file they must go directly to the source.

Basic connection packets???? I have over 240mb of my monthly bandwidth used up by Xolox in less than 1 day of installing. Are you saying that several 10's of pings can add upto this many MB?? Basically no. Thats impossible. I smell a cydoor scenario coming on....network highwaymen at their best, thats what I say.