cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
michael226
Aspiring Expert
1,975 Views
Message 1 of 8

Remote Administration - not always showing an blocked.

I usually see lots of entries for In Block [16] Remote Administration is my event log.  Typically I will see 4/8 entries an hour throughout the day and night.  I have read these are just the usual probing that occurs on the web and the log shows these are being blocked by the firewall - which is reassuring.

 

However, after some restarts I won't see any Remote Administration events in the log until the next restart (which might be 14 days away).  The firewall is still showing as being on during this time.

 

My question is why do I go from seeing pages of these entries (which I understand is normal) to none after some restarts?   

 

Does it mean the firewall is not working properly and letting these probes through sometimes?

 

Would be grateful for any reassurance.

 

Thanks.

 

 

0 Ratings
7 REPLIES 7
Ectophile
Distinguished Guru
1,941 Views
Message 2 of 8

Re: Remote Administration - not always showing an blocked.

After every restart, your IP address changes.  It may be that some addresses are known to the hackers, who are constantly probing them, while some aren't.

0 Ratings
michael226
Aspiring Expert
1,870 Views
Message 3 of 8

Re: Remote Administration - not always showing an blocked.

Sorry to raise this concern again ,but I just noticed that again that the 'blocked remote administration' entries have disappeared from my event log for over a week now (following a restart).

 

Whilst I understand that some IP address are less susceptible to being probed - it is really feasible that some IP address range are never probed?  The IP address is just the standard BT allocated range.  Is this likely?

 

Whilst it may sound odd, I quite like the positive assurance that remote access attempts are being blocked and when I stopped seeing these entries in the log its a little unsettling. (and i begin to wonder whether the hub firewall is still working).

 

 

 

 

 

 

 

 

0 Ratings
gg30340
Distinguished Sage
Distinguished Sage
1,858 Views
Message 4 of 8

Re: Remote Administration - not always showing an blocked.

Go to the Shields Up web site and run their test it will check your routers firewall.

 

https://www.grc.com/x/ne.dll?bh0bkyd2

0 Ratings
michael226
Aspiring Expert
1,847 Views
Message 5 of 8

Re: Remote Administration - not always showing an blocked.

Thanks, I'll try that later.

 

Will it show whether unauthorised attempts (like remote administration) are being blocked, as I've seen they commonly relate to ports 22, 80 and 443. 

0 Ratings
gg30340
Distinguished Sage
Distinguished Sage
1,833 Views
Message 6 of 8

Re: Remote Administration - not always showing an blocked.

It will test to see if ports are open. It will not show if attempts have been made to access them. That can only be done from the router.

0 Ratings
michael226
Aspiring Expert
1,829 Views
Message 7 of 8

Re: Remote Administration - not always showing an blocked.

Should I expect any port to be open (i.e. 80 and 443)?

0 Ratings
Liam_
Recognised Expert
1,821 Views
Message 8 of 8

Re: Remote Administration - not always showing an blocked.

They should show as Stealth.  Unless some application currently is listening on the port(s), in which case it may show either open or closed.

0 Ratings