Kerio

[Deke40]

Here is my Kerio log file. Why are there all these blocked packets from what looks like Tech Guys(Cermak)?

1,[16/Jan/2003 06:05:02] Rule 'Packet to unopened port received': Blocked: In TCP, 213.197.7.38:2267->localhost:21, Owner: no owner
1,[16/Jan/2003 06:05:06] Rule 'Packet to unopened port received': Blocked: In TCP, the-chief.038.conceptsfa.nl [213.197.7.38:2267]->localhost:21, Owner: no owner
1,[16/Jan/2003 06:05:12] Rule 'Packet to unopened port received': Blocked: In TCP, the-chief.038.conceptsfa.nl [213.197.7.38:2267]->localhost:21, Owner: no owner
1,[16/Jan/2003 06:23:14] Rule 'TCP ack packet attack': Blocked: In TCP, 24.137.3.117:80->localhost:2369, Owner: no owner
1,[16/Jan/2003 06:23:14] Rule 'TCP ack packet attack': Blocked: In TCP, 24.137.3.117:80->localhost:2369, Owner: no owner
1,[16/Jan/2003 06:23:14] Rule 'TCP ack packet attack': Blocked: In TCP, 24.137.3.117:80->localhost:2369, Owner: no owner
1,[16/Jan/2003 06:23:14] Rule 'TCP ack packet attack': Blocked: In TCP, ns4.cermak.com [24.137.3.117:80]->localhost:2368, Owner: no owner
1,[16/Jan/2003 06:23:14] Rule 'TCP ack packet attack': Blocked: In TCP, ns4.cermak.com [24.137.3.117:80]->localhost:2368, Owner: no owner
1,[16/Jan/2003 06:23:14] Rule 'TCP ack packet attack': Blocked: In TCP, ns4.cermak.com [24.137.3.117:80]->localhost:2368, Owner: no owner
1,[16/Jan/2003 06:23:14] Rule 'TCP ack packet attack': Blocked: In TCP, ns4.cermak.com [24.137.3.117:80]->localhost:2368, Owner: no owner
1,[16/Jan/2003 06:23:14] Rule 'TCP ack packet attack': Blocked: In TCP, ns4.cermak.com [24.137.3.117:80]->localhost:2368, Owner: no owner
1,[16/Jan/2003 06:23:14] Rule 'TCP ack packet attack': Blocked: In TCP, ns4.cermak.com [24.137.3.117:80]->localhost:2368, Owner: no owner
1,[16/Jan/2003 06:23:14] Rule 'TCP ack packet attack': Blocked: In TCP, ns4.cermak.com [24.137.3.117:80]->localhost:2368, Owner: no owner
1,[16/Jan/2003 06:23:16] Rule 'TCP ack packet attack': Blocked: In TCP, ns4.cermak.com [24.137.3.117:80]->localhost:2384, Owner: no owner
1,[16/Jan/2003 06:23:16] Rule 'TCP ack packet attack': Blocked: In TCP, ns4.cermak.com [24.137.3.117:80]->localhost:2384, Owner: no owner
1,[16/Jan/2003 06:23:16] Rule 'TCP ack packet attack': Blocked: In TCP, ns4.cermak.com [24.137.3.117:80]->localhost:2384, Owner: no owner
1,[16/Jan/2003 07:02:26] Rule 'TCP ack packet attack': Blocked: In TCP, 63.251.213.40:80->localhost:2560, Owner: no owner
1,[16/Jan/2003 07:10:40] Rule 'TCP ack packet attack': Blocked: In TCP, ns4.cermak.com [24.137.3.117:80]->localhost:2678, Owner: no owner
1,[16/Jan/2003 07:10:40] Rule 'TCP ack packet attack': Blocked: In TCP, ns4.cermak.com [24.137.3.117:80]->localhost:2678, Owner: no owner
1,[16/Jan/2003 07:10:40] Rule 'TCP ack packet attack': Blocked: In TCP, ns4.cermak.com [24.137.3.117:80]->localhost:2678, Owner: no owner
1,[16/Jan/2003 07:10:40] Rule 'TCP ack packet attack': Blocked: In TCP, ns4.cermak.com [24.137.3.117:80]->localhost:2678, Owner: no owner

 

[Davey7549]

Deke
Have a look at this link and the posters sublinks.
http://www.dslreports.com/forum/remark,3215844~root=security,1~mode=flat

Dave

 

[Deke40]

Thanks Dave. I decided to uncheck the two options for logging and I did that two days ago. I guess everthing is still working the same I'm just not logging the results.

From what I read Kerio must do a pretty good job.

Thanks again.

 

[Deke40]

I unchecked these rules and nothing seems to happen. I am not getting any pop up warning to accept or deny. I guess I should be able to delete these. I think these got in when I first configured and didn't understand.

 

[Davey7549]

Deke
Looks all is OK now! I wouldn't be concerned if no intrusion pop-ups are occuring.

Dave

 

[Deke40]

Dave

Thanks for the reassurance.

 

[Deke40]

This sure will make you a believer in firewalls. I got a hit from this address:

<img src="http://forums.techguy.org/attachment.php?s=&postid=689992">