Hallo,
Du sagst was von FW-Log. Wo finde ich das , denn bei Nis stehen wohl Einträge über Warnungen und Meldungen, aber dass mein Computer sich selbst angreift, schreibt er nicht. Da geht immer nur ein Fenster auf , das ich leider nicht kopieren kann und der Eintrag der da drin steht habe ich ganz oben schon aufgeführt.
Also irgendetwas mit Invalid source IP-Adress.
Hab da was gefunden :
Details: Zugriffsversuch: Invalid Source IP Address
Angreifer: 255.255.255.255
Risikostufe: Niedrig
Quell-IP-Adresse: 255.255.255.255. Diese IP-Adresse ist ungültig.
Ziel-IP-Adresse: 217.xxx.xx.xx
Protokoll: ICMP.
Klicken Sie auf die Adresse, um den Angreifer zurückzuverfolgen
Weitere Informationen über diesen Angriff erfahren Sie unter Symantec Security Response
Das schreibt NIS in der Online-Erklärung, kann selbst aber nicht viel damit anfangen , weil mein englisch sehr schlecht ist.
Invalid Source IP Address
Severity: Low
This attack poses a minor threat. Corrective action may not be possible or is not required.
Attack Category: Suspicious Activity
Anomalous network conditions or traffic patterns. A suspicious activity signature, for example, might detect two systems with identical IP addresses, a condition that indicates an attempted IP spoofing attack.
Description
This attack signature detects packets that have an invalid source IP address. Although theoretically IP addresses can range from 0.0.0.0 to 255.255.255.255, some values within this range are either reserved by the IANA (Internet Assigned Numbers Authority) or have special meaning that would preclude them from being used as a source IP address. Examples of these are IPs that have a 0 in the most significant octet like 0.64.189.203 or IP addresses that are in the range 240.0.0.0 to 255.255.255.255.
This intrusion may indicate that someone is attempting to hide an attack on your computer using random source IP addresses.
Additional Information
This intrusion is only detected on Windows 98, 98SE, Me, and NT 4.0.
False Positive
Some Internet service providers (ISPs) periodically send their dial-up customers ICMP packets with the source IP set to 255.255.255.255. It is unclear why this is done, but one possibility is that the ISP is attempting to determine the status of the dialed-in computer. Norton Internet Security and Norton Personal Firewall automatically block these packets, which may cause your ISP to drop connections from your computer. If you have connection problems when this attack signature is active, you may need to disable the attack signature.
Gruss
