Karl Levinson, mvp wrote:

There are ways you can research these things... however, you will get so
many of these alerts, and it is so fruitless to research them all, that I
strongly recommend you consider a firewall configuration that does not alert
you all the time with these things. Having a firewall ask the user to make
decisions is a security accident waiting to happen, and is also a
significant consumption of your time.

If and when you do want to research these things, you should look up what
the remote IP address is, for example starting with the DNS name lookup and
whois lookup at www.nwtools.com [which also gets the DNS name and a lot of
other things] or www.netsol.com to find out what that IP address is and
whether you or your computer could have had reason to contact it. This IP
is named dns1.snfcca.sbcglobal.net, which is a big hint that suggests this
is probably normal.

It's also useful to know what the protocol [e.g. TCP] and remote port number
is... the firewall alert below didn't seem to tell you, which is really
dumb. If the remote port was, say, TCP 80 or UDP 53, then that gives you
some level of assurance that this is a response to something your computer
requested. There is no such thing as "port 1258." There's TCP port 1258,
and UDP port 1258. Any firewall that doesn't know that this is important
information is dumb [although I generally like Sygate].

A really smart firewall would let you inspect the TCP flags and contents of
the incoming packet, but I guess that's too much to ask.


You make good points, and I really like your nwtools.com and netsol.com
suggestions.

However, to expect the average user to understand what the different
protocols are, what they do, and what ports are used for what, is a bit
over the top. Like you hinted at, the firewall responses to incoming and
outgoing packets should be as automated as possible for the average user.

And, yes, it is a bit too much to ask your firewall to let you inspect
the packets. 99% of the users wouldn't have a clue anyway. And if you're
competent enough to know what to look for, and have the time, then
you're going to have to invest a bit more than fifty bucks for the
privilege of doing so.

Since so many users don't even HAVE a decent software firewall
installed, this poster is at least making an attempt to protect his
system - I commend him for that!


--
The reader should exercise normal caution and backup the Registry and
data files regularly, and especially before making any changes to their
PC, as well as performing regular virus and spyware scans. I am not
liable for problems or mishaps that occur from the reader using advice
posted here. No warranty, express or implied, is given with the posting
of this message.