On Tue, 28 Oct 2003 19:00:43 -0500, =?iso-8859-1?Q?Omar=A9?=
<omar@yahoo.com> wrote:

>Hi Sponge I need help.
>for the past week my walwatcher log shows an entry
>every minute or two incoming from 127.0.0.1 (my self?)
>and the remote port as 80. I have tried every thing I
>can think of to no avail, did run Adaware and Spybot +
>NAV and all are negative. The data LED's on the router
>and cable modem shows no activity while the other LED's
>blink constantly but it did that before and the logs
>show nothing.I am out of ideas, got any?
>Thanks Omar

Try this: go into DOS (or on Win2k or XP, run CMD from the Start/Run
menu) and run the command ROUTE PRINT at the command prompt. Let me
know what you see. Do this for each host on your network around the
time you are observing this. Also check the routing table on your
router.

I'm thinking what it may be is that one (or more) of the machines on
your LAN may have a bad routing table. Or the router itself. Usually,
the only localhost-related route would look like the following:

Active Routes:

Network Add Netmask Gateway Address Interface Metric
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.1.18 255.255.255.255 127.0.0.1 127.0.0.1 1

This came from one of my machines. In this case, the first entry sends
any packets coming from 127.x.x.x to 127.0.0.1. The second rule sends
any packets coming from your machine's IP address to 127.0.0.1. Some
applications, like Windows Media Player, will try to send packets to
the machine's own IP address if they can't phone home.

It's also possible your router has a bad routing table. Check that as
well. There should be no entries relating to localhost (127.x.x.x) in
its routing table.

Sponge
Sponge's Secure Solutions
www.geocities.com/yosponge
My new email: yosponge2 att yahoo dott com