View Full Version : Norton Firewall Attack


spook
17-02-2005, 14:51
I have Norton Firewall and AV on my 'pootah.

Every so often the firewall will tell me that I've been attacked and you have the option for it to tell you where the attack has come from.

Just recently I've been having loads of attacks which seem to come from the same place - it says it's from a BT Broadband and it's always as below:

notify: net-ops@bt.net
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: BTNET-MNT
mnt-routes: BTNET-MNT
changed: hostmaster@ripe.net 20000920
changed: hostmaster@ripe.net 20010620
changed: hostmaster@ripe.net 20020910
source: RIPE

inetnum: 217.42.0.0 - 217.44.255.255
remarks: ************************************************** ***
remarks: * Please send abuse reports to abuse@btbroadband.com *
remarks: ************************************************** ****
netname: BT-CENTRAL-PLUS
descr: IP pools
country: GB
admin-c: BTCP1-RIPE
tech-c: BTCP1-RIPE
status: ASSIGNED PA
remarks: Please send abuse notification to abuse@btbroadband.com
mnt-by: BTNET-MNT
mnt-lower: BTNET-MNT
mnt-routes: BTNET-MNT
changed: preston.dialip@bt.com 20020404
changed: preston.dialip@bt.com 20020824
changed: preston.dialip@bt.com 20021113
changed: preston.dialip@bt.com 20040119
changed: eva.shepherd@bt.com 20040426
changed: preston.dialip@bt.com 20040608
source: RIPE

% RIPE database, last updated Feb 16, 2005 12:10:33 AM

Those of you familiar with Norton will know that you can block individual IP addresses which I do each time that I'm attacked but this one pops up with alarming regularity.

Does anyone have any comments/suggestions?

I have emailed the abuse email previously but never had a reply.

vidster
17-02-2005, 16:34
If i understand this right, it is just BT Broadband 'pinging' your computer. I had the same thing with Sygate every 20 mins or so. It was AOL doing the same thing.
I believe it is just checking your online status, although someone will let you know if i am wrong ;).

steev
18-02-2005, 16:10
Originally posted by spook
inetnum: 217.42.0.0 - 217.44.255.255

You haven't included the actual IP address you want to check, just the results, with BT's block address (or 1 of them)

If it's the same IP address every time, it would suggest that it's either part of their infastructure, or someone on bband with a static IP address.

If you post the IP address, I'm sure someone here will check it out for you.

mr.blaze
18-02-2005, 18:56
BT also port scan users on their networks to look for vulnerabillities apparently. I had them trying to port scan me a while back and I was told it was routine.