# What can I do about attempts to breach my firewall?

**URL:** <https://boards.straightdope.com/t/what-can-i-do-about-attempts-to-breach-my-firewall/150428>\
**Category:** Factual Questions\
**Created:** [January 23, 2003, 1:46pm UTC](https://boards.straightdope.com/t/what-can-i-do-about-attempts-to-breach-my-firewall/150428 "2003-01-23T13:46:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jervoise](https://avatars.discourse-cdn.com/v4/letter/j/d2c977/32.png) [@Jervoise](https://boards.straightdope.com/u/Jervoise)\
**Post date:** [January 23, 2003, 1:46pm UTC](https://boards.straightdope.com/t/what-can-i-do-about-attempts-to-breach-my-firewall/150428/1 "2003-01-23T13:46:56Z")

</div>

Hi everyone,

Like many people, I use ZoneAlarm on my personal computer. I’m not particularly afraid of hackers accessing my computer – I’m on a 56k modem for crissakes 🙂 – but it’s comforting to know it’s there.

The past three hours, Zonealarm has logged nearly 100 (and climbing) attempted port scans. Most of them come from a two IP addresses. The targeted ports are port 2000 and port 137. (I read port 137 is for network traffic, but my computer is currently a stand-alone.)

So my GQ is: what can be done about these repeated attempts? ZoneAlarm is reporting the IP address and ISP of the computer attempting to connect to my computer – do I have any recourse in that direction?

Also, should I be worried about these attempts? (I’m not particularly perturbed, but it’d be nice to know whether this is something to be concerned about.)

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![Una\_Persson](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/una_persson/32/346_2.png) [@Una\_Persson](https://boards.straightdope.com/u/Una_Persson)\
**Post date:** [January 23, 2003, 1:48pm UTC](https://boards.straightdope.com/t/what-can-i-do-about-attempts-to-breach-my-firewall/150428/2 "2003-01-23T13:48:50Z")

</div>

Please see this link:

[http://www.robertgraham.com/pubs/firewall-seen.html](http://www.robertgraham.com/pubs/firewall-seen.html)

It will help you out very much. Note that it says Port 137 is nothing to really be concerned with.

---

<div class="post-metadata">

**Author:** ![Nightsong](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/nightsong/32/3083_2.png) [@Nightsong](https://boards.straightdope.com/u/Nightsong)\
**Post date:** [January 23, 2003, 4:29pm UTC](https://boards.straightdope.com/t/what-can-i-do-about-attempts-to-breach-my-firewall/150428/3 "2003-01-23T16:29:49Z")

</div>

Actually, one thing that may be connected: spammers are now using a built-in tool for some versions of Windows that’s meant for network admins and the like. I belive that ports 137 and 2000 are the ones it tries to use. (Warning: I’m remembering those port #'s vaguely from a bit of experimentation I did with my home network, so I may be off on the ports. But, those ones sound familiar.)

Here’s a link with more info on it: [http://www.stopmessengerspam.com/](http://www.stopmessengerspam.com/)

* * *

\<\< Yum. \>\>

---

<div class="post-metadata">

**Author:** ![Jervoise](https://avatars.discourse-cdn.com/v4/letter/j/d2c977/32.png) [@Jervoise](https://boards.straightdope.com/u/Jervoise)\
**Post date:** [January 24, 2003, 12:22am UTC](https://boards.straightdope.com/t/what-can-i-do-about-attempts-to-breach-my-firewall/150428/4 "2003-01-24T00:22:17Z")

</div>

Thanks for those links, guys. I’ll check them out.