# Port Scan Attack



## Brisingr (Apr 20, 2010)

Sorry if this is in the wrong section. I wasn't sure if it was this one or not.

I recently upgraded my wireless router to a Linksys Simultaneous Dual-Band Router, WRT400N. I also have a Linksys Dual-Band USB Wireless Adapter on my desktop. The adapter is nothing new, and I have had it for about a year. However, ever since the new router, every ten minutes or so, I get a notice from Symantec Endpoint Protection, telling me that a Port Scan Attack has been blocked. The IP address' blocked include, "192.168.1.1", "192.168.1.255", "192.168.1.100". My desktop's personal IP address is, "192.168.1.101"

The logs show that the protocol's for each of these blocked events vary between UDP, TCP, and most common, ETHERNET. Also, the remote ports 6646, 2057, 2056, 138, 1196. Some are outgoing events, but are mostly incoming. The most confusing thing being, the majority of these events are instantaneous, as in, the begin and end time of the attack are the same second, while others last, according to the security bubble, EXACTLY 10 mins, to the second. 

The Symantec Endpoint Protection says the rule for these events is "Block_all".

Any hints or tips to what this even is, especially a way to get rid of it, would be much appreciated.


----------



## inphektion (Apr 13, 2010)

is there a way to turn off the easylink advisor? 
do you have anything in the router configured for applications and gaming?

This is def. some of the routers little features doing stuff to scan the network. Nothing bad so I'd say either turn off some of those features of the router where possible or tell symantec not to notify you of those specific alerts anymore.


----------



## Brisingr (Apr 20, 2010)

The only configuration I have is for World of Warcraft. I opened those ports to my computers IP Address. Ironically, I spent the money on a dual-band router/adapter because I wanted to play WoW better. In game, the game tends to do a lag freeze, where I can't do anything, every 5-10 mins or so. It's like clockwork. But dual-band hasn't made it any better. Nothing's any faster, actually.

I've looked at all the features of the router, and can't find a feature that would cause this. Not sure how to tell Norton to shut up about it, either, really.


----------

