Norton blocking Subspace

[Izrath]

Figured I would report this... When I logged into TW just now I got d/c a few minutes later, Norton had blocked it with the following message:

Norton Internet Worm Protection has detected and blocked an intrusion attempt.

Intrusion: MS SQL PacketRsolution DoS.
Intruder: swz.sscx.net(66.36.241.110)(5400).
Risk Level: Medium.
Protocol:UDP.
Attacked Port: ms-sql-m(1434).

I had to go in and exclude it in order to connect to TW again. Is this normal?

[Scoop]

Figured I would report this... When I logged into TW just now I got d/c a few minutes later, Norton had blocked it with the following message:

Norton Internet Worm Protection has detected and blocked an intrusion attempt.

Intrusion: MS SQL PacketRsolution DoS.
Intruder: swz.sscx.net(66.36.241.110)(5400).
Risk Level: Medium.
Protocol:UDP.
Attacked Port: ms-sql-m(1434).

I had to go in and exclude it in order to connect to TW again. Is this normal?

this should probably be in tech

[Kolar]

Tech Support

That should be normal. This has a list of ports you need open for Continuum http://forums.trenchwars.org/showpos...7&postcount=19.

[Subjugation]

Figured I would report this... When I logged into TW just now I got d/c a few minutes later, Norton had blocked it with the following message:

Norton Internet Worm Protection has detected and blocked an intrusion attempt.

Intrusion: MS SQL PacketRsolution DoS.
Intruder: swz.sscx.net(66.36.241.110)(5400).
Risk Level: Medium.
Protocol:UDP.
Attacked Port: ms-sql-m(1434).

I had to go in and exclude it in order to connect to TW again. Is this normal?

Although that's the correct IP and port, I'm not sure if Norton should be recognizing it as a "MS SQL PacketRsolution DoS" attack. In any event, you can do a couple of things....manually configure your firewall to permit inbound UDP from that IP and port while you're playing, and just go into the "programs" tab and "block" while you're not playing.

But that brings up a question I have...if you can spoof an IP address, can't you just spoof the TW server IP and penetrate a user's computer through port 5400? Not like I have anything to compromise, but I would still like to know.

[Subjugation]

But that brings up a question I have...if you can spoof an IP address, can't you just spoof the TW server IP and penetrate a user's computer through port 5400? Not like I have anything to compromise, but I would still like to know.

Nobody knows? I thought you guys were 1337 h4x0rz.

[Adrenaline Rush]

I don't know much about it, but maybe this website can give some ideas.
http://www.iss.net/security_center/a...ng/default.htm

[Doc Flabby]

I don't know much about it, but maybe this website can give some ideas.
http://www.iss.net/security_center/a...ng/default.htm

that relates to TCP and has nothing to do with subspace.

subspace uses UDP.

Spoofing packets wouldnt work as the connection is encrypted the spoofed packed would be ignored by the continuum client.

norton likes to flag up innocent packets so it looks like its acctually doing something. its a piece of shit really that slows down your computer...If you are behind a router and using XP the inbuild windows firewall is enough to protect you IMO

[Subjugation]

thx doc.