Zone Alarm Message: The firewall has blocked Internet access to your computer (ICMP Time Exceeded) from 146.188.200.241.

[John P]

Ok, what does this mean and who does this address belong to? I get the message all the stinking time. Is it something normal from my ISP that I should ignore or some idiot trying to hack into my computer? And how could that attempt get through my Soho 2000 hardware firewall/router for Zone Alarm to detect anyway?? All things I am clueless about. Hopefully you experts can tell me waddup????

 

[Adul]

tracert brings this up


1 * 10 ms 21 ms 10.74.164.1
2 26 ms 19 ms 37 ms 10.0.211.21
3 12 ms 12 ms 12 ms c1-pos4-0.phnxaz1.home.net [24.7.74.165]
4 36 ms 21 ms 18 ms c1-pos2-0.sndgca1.home.net [24.7.65.134]
5 20 ms 19 ms 39 ms c1-pos1-0.anhmca1.home.net [24.7.64.69]
6 67 ms 21 ms 22 ms c1-pos1-0.lsanca1.home.net [24.7.65.169]
7 77 ms 26 ms 24 ms 24.7.70.82
8 47 ms 23 ms 24 ms 0.so-0-2-0.XL1.LAX9.ALTER.NET [152.63.114.242]
9 167 ms 29 ms 23 ms 0.so-0-0-0.TL1.LAX9.ALTER.NET [152.63.115.138]
10 51 ms 358 ms 124 ms 0.so-6-1-0.TL1.POR3.ALTER.NET [152.63.0.121]
11 48 ms 48 ms 48 ms 0.so-6-0-0.XL1.SEA1.ALTER.NET [152.63.38.82]
12 56 ms 61 ms 47 ms 0.POS5-0.XR1.SEA1.ALTER.NET [152.63.106.226]
13 49 ms 50 ms 49 ms 195.ATM6-0.GW3.SEA4.ALTER.NET [146.188.200.241]

 

[LordOfAll]

What port is it accessing?

 

[John P]

How do you tell what port is is trying to access? Looking at my Watchguard Soho event log it says

"Packet discarded from 146.188.200.241 to (my IP) protocol 1 "

If that means anything to you.

The Zone Alarm message tends to pop up as soon as I access a web page, which makes me think it could be something normal? Could it have something to do with Norrton Antivirus? I installed it at the same time as Zone Alarm. I was using Sygate Personal firewall before and never had any of these problems.

 

[LordOfAll]

Look at the ZA log file for more info. It is usually in the windows directory in the internet logs folder.

 

[medic]

UUNET PIPEX (NET-UUNET-PIPEX)
332, Science Park
Cambridge
England
CB4 4BZ
GB

Netname: UUNET-PIPEX
Netblock: 146.188.0.0 - 146.188.255.255

Coordinator:
UUNET, Technical Support (OA12-ARIN) help@uu.net
(800) 900-0241

Domain System inverse mapping provided by:

AUTH00.NS.UU.NET 198.6.1.65
AUTH51.NS.UU.NET 198.6.1.162

Record last updated on 10-Oct-1996.
Database last updated on 7-Dec-2001 19:54:45 EDT.

The ARIN Registration Services Host contains ONLY Internet
Network Information: Networks, ASN's, and related POC's.
Please use the whois server at rs.internic.net for DOMAIN related
Information and whois.nic.mil for NIPRNET Information.

 

[John P]

CRV,
I had found that information also. WTF does it mean?

What exactly do I look for in the ZA log?

 

[Windogg]

Hmmm... seems like a ping request that didn't get completed. The code 1 indicates the fragment was tossed because the Time To Live hit zero. Ports are a non issue since ICMP does not go far enough up the protocol stack.

I wouldn't worry. Seems like normal traffic as opposed to a targeted attack.

Windogg

 

[John P]

Windogg,
What do you mean by normal traffic? Why would that IP be trying to contact my computer, looking for cookies or something like that??

 

[John P]

Hmmmm, searching www.google.com for "195.ATM6-0.GW3.SEA4.ALTER.NET" comes up with a whole bunch of spamming advertising crap. I wonder if it's one of those spyware deals trying to look for cookies or whatever on my computer?

 

[Windogg]

A lot of things can cause this message depending on the situation. Without getting too deep into the OSI model and how traffic moves across the net, your router may just be passing through regular traffic. The "ICMP Time Exceeded" could just be TRACERT expiring at your router. It could even be caused by banner ads.

Windogg

 

[John P]

Thanks Windogg. I'm just gonna click the little "click here to not show this message box" or whatever next time it shows up.