My firewall occasionally says that another computer is scanning my computer’s ports, and that it’s been blocked. It gives the IP address. How can I find out who this is without going to that address?
You can find out some information about it by entering it into the “Search WHOIS” box in the upper right area of this page.
Thank you.
Doing your own forensics on things like firewall traffic can be quite the fulfilling and satisfying hobby. I applaud anyone wanting to take that geeky plunge, the water is lovely.
However, there are a signifigant amount of folks for whom the idea of determining if the firewall alert is for “acceptable” or “hostile” activity, looking up IP ownership, and filing some sort of formal complaint…prompts projectile vomiting.
For these folks (as well as the avid geeky hobbiest who might want a few extra hours to devote to things like grocery shopping, changing the oil in the car, or perhaps spending time with those strange people who share your house and keep calling you odd names like “Honey”, “Mom” or “Dad”)…I highly recommend signing up for MyNetWatchman (http://www.mynetwatchman.com/).
Simply put, you download their software, tell the software where your firewall logs are located, decide how much visibility you want to have into the automation, and…magical chimes…the service collects, analyzes, prioritizes, and reports your firewall traffic for you to the appropriate parties who A) care and B) can do something about any malicious activity.
Good stuff.