TomFace 539 Posted October 9, 2017 Share Posted October 9, 2017 (edited) I know we kicked this around previously (https://forum.eset.com/topic/10660-icmp-flood-attacks/?do=findComment&comment=54320), but on occasion I am getting a warning when I scan my network and at the same tome I also get this notice (which seems contradictory to me). When I go into my router webpage I am finding this after I delete that service, I do not get any (either notice) warning notice from ESS when doing a network scan (I am NOT a gamer). I also see that ESS shows this Not being the brightest bulb in the box, I am confused as to what to make of all this and if I should be concerned. Could someone please explain it to me in plain English and what if any actions I need to take. I am running Win 7 Home Prem and ESS 10.1.219.0 (ESS Firewall in Automatic/default mode). I do not take any actions to change ports as I do not have that knowledge, so I don't think it's anything that I am doing. What else could be causing this? Edited October 9, 2017 by TomFace Link to comment Share on other sites More sharing options...
Most Valued Members cyberhash 194 Posted October 9, 2017 Most Valued Members Share Posted October 9, 2017 As far as ESS is concerned you have everything set correctly . Your router must come with a built in rule to allow port forwarding for that port if you have never added it manually. If you delete it and it comes back in the future, then i can only assume that AT&T are adding it every time they are running a pushed firmware update for your router. Service name "ConnectToCiscoAP" is to allow router access to AT&T's wireless set-top boxes Link to comment Share on other sites More sharing options...
TomFace 539 Posted October 9, 2017 Author Share Posted October 9, 2017 (edited) 41 minutes ago, cyberhash said: As far as ESS is concerned you have everything set correctly . Your router must come with a built in rule to allow port forwarding for that port if you have never added it manually. If you delete it and it comes back in the future, then i can only assume that AT&T are adding it every time they are running a pushed firmware update for your router. Service name "ConnectToCiscoAP" is to allow router access to AT&T's wireless set-top boxes Thanks Hash...seems to be a hit and miss type thing...when I delete it I notice no restrictions in PC behavior. But why the conflicting reports from ESET? If it's necessary for HTTPS protocol why warn me about it? Maybe I am over simplifying it, but if it's OK then it's OK, if it's bad then it's bad. ESS is telling me both things at the same time in the same notice (one on top of the other). Edited October 9, 2017 by TomFace Link to comment Share on other sites More sharing options...
Most Valued Members cyberhash 194 Posted October 9, 2017 Most Valued Members Share Posted October 9, 2017 1 minute ago, TomFace said: Thanks Hash...seems to be a hit and miss type thing...when I delete it I notice no restrictions in PC behavior. But why the conflicting reports from ESET? If it's necessary for HTTPS protocol why warn me about it? HTTPS scanning on port 443 is standard in any security suite , where as port 443 either being open or forwarded on your router could pose a security risk and why it's giving you the warning. Although it might not seem like it , these are 2 different things entirely. The only similarity is the port number and why it's a bit confusing. Link to comment Share on other sites More sharing options...
Most Valued Members cyberhash 194 Posted October 9, 2017 Most Valued Members Share Posted October 9, 2017 You could also run the various tests from this site to double check things from the internet > your network. Rather than the Eset > home network tests you are running just now.https://www.grc.com/x/ne.dll?bh0bkyd2 Link to comment Share on other sites More sharing options...
TomFace 539 Posted October 9, 2017 Author Share Posted October 9, 2017 3 minutes ago, cyberhash said: You could also run the various tests from this site to double check things from the internet > your network. Rather than the Eset > home network tests you are running just now.https://www.grc.com/x/ne.dll?bh0bkyd2 I've run the exposure test before and it comes back "THE EQUIPMENT AT THE TARGET IP ADDRESS DID NOT RESPOND TO OUR UPnP PROBES!" Which I guess is good. Link to comment Share on other sites More sharing options...
Most Valued Members cyberhash 194 Posted October 9, 2017 Most Valued Members Share Posted October 9, 2017 Yes no response/answer is a good thing Link to comment Share on other sites More sharing options...
TomFace 539 Posted October 9, 2017 Author Share Posted October 9, 2017 So should I be concerned about Can I do anything to stop this silliness? Link to comment Share on other sites More sharing options...
Most Valued Members cyberhash 194 Posted October 9, 2017 Most Valued Members Share Posted October 9, 2017 Is this screenshot from before you deleted that rule within your routers firewall ? . If you remove the rule and re-run the home network test within ESET it should no longer be an issue. Link to comment Share on other sites More sharing options...
itman 1,740 Posted October 9, 2017 Share Posted October 9, 2017 Do you have U-Verse? AT&T in their "infinite wisdom" uses port 443 on the WAN side of thier PACE routers for the desktop TV boxes. If you run GRC Shields UP test, you will see that port 443 is open. It is closed on the LAN side which is all that counts. Link to comment Share on other sites More sharing options...
TomFace 539 Posted October 10, 2017 Author Share Posted October 10, 2017 (edited) 3 hours ago, itman said: Do you have U-Verse? AT&T in their "infinite wisdom" uses port 443 on the WAN side of thier PACE routers for the desktop TV boxes. If you run GRC Shields UP test, you will see that port 443 is open. It is closed on the LAN side which is all that counts. Yes to U-Verse...how do I see the LAN side to know for sure? I have not fooled with the router settings (except deleting this service as explained above). The GRC Instant UPnP Exposure Test give a reply of "THE EQUIPMENT AT THE TARGET IP ADDRESS DID NOT RESPOND TO OUR UPnP PROBES!"...am I running the correct test? Edited October 10, 2017 by TomFace Link to comment Share on other sites More sharing options...
itman 1,740 Posted October 10, 2017 Share Posted October 10, 2017 (edited) 15 hours ago, TomFace said: The GRC Instant UPnP Exposure Test give a reply of "THE EQUIPMENT AT THE TARGET IP ADDRESS DID NOT RESPOND TO OUR UPnP PROBES!"...am I running the correct test? No. You want to run the "Common Ports" test. It will show that port 443 is open on your router. Again, all it is testing is the WAN side of your router. As far as your AT&T router goes, your firewall settings should correspond to what is shown in the below screen shot. Verify that the IP address shown corresponds to your ISP address. Again, what is being shown is that port 443 is open on the WAN side of the router and it can only connect to your AT&T assigned IP address. Don't "fool" with that setting or you will lose connectivity to your TV desktop devices. The NAT/Gaming screen shot you posted are default NAT settings for popular games. I never fooled with those settings and they are only used to bypass NAT when playing one of the referenced games. As far as Eset's router checking goes, all it is checking it the port status on the LAN side of your router. I have never used it because I have always used Eset's firewall public profile. The test is only for the private network profile. Edited October 10, 2017 by itman Link to comment Share on other sites More sharing options...
TomFace 539 Posted October 10, 2017 Author Share Posted October 10, 2017 (edited) 1 hour ago, itman said: No. You want to run the "Common Ports" test. It will show that port 443 is open on your router. Again, all it is testing is the WAN side of your router. As far as your AT&T router goes, your firewall settings should correspond to what is shown in the below screen shot. Verify that the IP address shown corresponds to your ISP address. Again, what is being shown is that port 443 is open on the WAN side of the router and it can only connect to your AT&T assigned IP address. Don't "fool" with that setting or you will lose connectivity to your TV desktop devices. The NAT/Gaming screen shot you posted are default NAT settings for popular games. I never fooled with those settings and they are only used to bypass NAT when playing one of the referenced games. As far as Eset's router checking goes, all it is checking it the port status on the LAN side of your router. I have never used it because I have always used Eset's firewall public profile. The test is only for the private network profile. The AT&T screen you are showing does not look like what I have...This is what I see at my IP web address without logging in...where are you finding that screen? I have never seen that before. I have U-Verse interne and TV (no U-Verse phone). I cannot locate the common port test at GRC...can you please provide a link to it? Edited October 10, 2017 by TomFace Link to comment Share on other sites More sharing options...
itman 1,740 Posted October 10, 2017 Share Posted October 10, 2017 Continuing ............. Eset's router diagnostic tool is not the issue in this instance. What it alerted to is: 1. There is an open connection on the WAN side of the router. 2. That connection is active i.e. connected to an IP address. 3. It is theoretically possible that an attacker is using the connection. The tool "can't look inside" existing router firewall rules to determine the above is by design. Link to comment Share on other sites More sharing options...
itman 1,740 Posted October 10, 2017 Share Posted October 10, 2017 4 minutes ago, TomFace said: I cannot locate the common port test at GRC...can you please provide a link to it? https://www.grc.com/x/ne.dll?rh1dkyd2 Link to comment Share on other sites More sharing options...
TomFace 539 Posted October 10, 2017 Author Share Posted October 10, 2017 1 minute ago, itman said: https://www.grc.com/x/ne.dll?rh1dkyd2 This is what I get (and also received yesterday) when trying that link Browser Reload Suppressed For your security, your web browser's "reload" function has been temporarily disabled Allowing a web browser to "reload" a page which has already been sent to you creates a "security hole" that would allow someone using your computer at any later time to attain potentially private and personal information. To safeguard your privacy we have disabled the browser's "reload" or "refresh" facility while you are in sensitive areas of our web site. Reloading pages will function normally once you have left this area . . . but until then please refrain from "reloading" pages. You may press your browser's [BACK] button now to return to the page prior to the one you were just viewing. Thanks very much for your interest and patronage. Link to comment Share on other sites More sharing options...
itman 1,740 Posted October 10, 2017 Share Posted October 10, 2017 8 minutes ago, TomFace said: The AT&T screen you are showing does not look like what I have...This is what I see without logging in Obviously, were have different routers. Appears you might have any older one. You will probably have to go into "Firewall Advanced" settings to find the hardcoded port 443 rule to AT&T Link to comment Share on other sites More sharing options...
itman 1,740 Posted October 10, 2017 Share Posted October 10, 2017 1 minute ago, TomFace said: This is what I get (and also received yesterday) when trying that link Works for me in IE11 running Win 10 1703. Link to comment Share on other sites More sharing options...
TomFace 539 Posted October 10, 2017 Author Share Posted October 10, 2017 (edited) 4 minutes ago, itman said: Works for me in IE11 running Win 10 1703. I'm IE11.0.9600.18792/Win 7 Home Prem/Svc Pack 3 and current on updates (except telemetry add-ons) Edited October 10, 2017 by TomFace Link to comment Share on other sites More sharing options...
itman 1,740 Posted October 10, 2017 Share Posted October 10, 2017 (edited) I just got the "suppression" screen now. Might be a problem with their web site or if you access it once and then try again, it will throw the message. Delete temp files in IE and try again. If still a no go, exit IE and restart it and try. Edited October 10, 2017 by itman Link to comment Share on other sites More sharing options...
TomFace 539 Posted October 10, 2017 Author Share Posted October 10, 2017 (edited) OK...will try again in a bit. I'll also nose around in advanced firewall setting as well and see what's there (I think I ale\ready did that and nothing caught my eye). I don't change things that I don't understand. Edited October 10, 2017 by TomFace Link to comment Share on other sites More sharing options...
itman 1,740 Posted October 10, 2017 Share Posted October 10, 2017 4 minutes ago, itman said: If still a no go, exit IE and restart it and try. This did the trick for me. Link to comment Share on other sites More sharing options...
itman 1,740 Posted October 10, 2017 Share Posted October 10, 2017 Here is a DSL Reports posting that pretty much sums up the UVerse port 443 issue: Quote Port 443 is used by the Uverse WAP to provide signal to wireless receivers. So in essence if have wireless receivers for Uverse IPTV then port is not accessible to other devices. If have internet only or all hardwired receivers then port 443 should be available to my knowledge. http://www.dslreports.com/forum/r29870607-Port-443-block Also I don't believe the above is 100% accurate. I had just plain AT&T DSL a few years back in another state I resided in at the time. No WAP was involved and PC connected via Ethernet. As I recollect, port 443 was still allocated on the router which was a Netopia one. The answer, I believe I found at the time for why that was so, is AT&T used it for "connectivity" testing and verification purposes. Best way to test internal LAN status is open an admin command prompt window and type: netstat -anob This will display that status of all ports and what programs at using them. Link to comment Share on other sites More sharing options...
TomFace 539 Posted October 10, 2017 Author Share Posted October 10, 2017 (edited) I appreciate all the information itman, but the basic question I have is should I be concerned about this? And if so, what can I do about it? Sorry if I seem dense, but I understand plain verbiage best. I also sent GRC an e-mail about the Common Ports scan as I still cannot access that webpage from either IE11 or Firefox 56.0.1 Edited October 10, 2017 by TomFace Link to comment Share on other sites More sharing options...
itman 1,740 Posted October 10, 2017 Share Posted October 10, 2017 (edited) 51 minutes ago, TomFace said: I appreciate all the information itman, but the basic question I have is should I be concerned about this? Since you are concerned about it, I would contact AT&T tech support and ask them about port 443 usage on the router. If they say "Yes, it is used," then ask them to run a test to verify it is only connecting to your local AT&T IP address. If all checks out, I wouldn't be concerned about what the Eset test tool is stating. Edited October 10, 2017 by itman Link to comment Share on other sites More sharing options...
Recommended Posts