Kerio alerts

[Geordie2]

I use Kerio firewall with one of Sponge's lists, and the combination
seems to work pretty well. Which is just as well as I'm relatively new
to firewalls and not always that sure whats going on.

Tonight for several hours, I've had Kerio constantly warning me every
few minutes of:

ICMP [8] Echo Request from modem-1735.crocodile.dialup.pol.co.uk
[81.78.38.199] was blocked by rule 'Block ICMP'

Sometimes the first part of the address varies, but the
dialup.pol.co.uk part is always the same.

Anything to particularly worry about - the messages are frequent and
annoying?

Geordie2

[Lu Tze]

"Geordie2" <nospam@eidosnet.co.uk> wrote in message
news:r542lv4hd6hiof0elsl1fllbt2vlh3jcdb@4ax.com...
> I use Kerio firewall with one of Sponge's lists, and the combination
> seems to work pretty well. Which is just as well as I'm relatively new
> to firewalls and not always that sure whats going on.
>
> Tonight for several hours, I've had Kerio constantly warning me every
> few minutes of:
>
> ICMP [8] Echo Request from modem-1735.crocodile.dialup.pol.co.uk
> [81.78.38.199] was blocked by rule 'Block ICMP'
>
> Sometimes the first part of the address varies, but the
> dialup.pol.co.uk part is always the same.
>
> Anything to particularly worry about - the messages are frequent and
> annoying?
>
> Geordie2
>
If you look at your ip address you see that your post came from 81.78.6.158.
The echo request came from 81.78.38.199 which is on the same sub-net range
as yourself.
In the current worm infestation on the net it is noticeable that icmp(8)
requests are frequently a compromised host scanning other address ranges
within it's own sub-net.
I.E. if you are on btinternet most of the requests in your log would be from
other machines within the network range common to that isp.
Hope that makes sense.


Lu Tze

Whale Oil Beef Hooked.