«

I have an 804 and it has been working fine. However, I recently
switched ISPs and have noticed a problem.

It appears that my box is being "pinged/accessed" quite frequently by
machines from outside. I am running NAT, so nothing is getting
through, but the activity is keeping the line up.

How would I set up a filter that would ignore this traffic when coming
unrequested from the other side as valid line activity for the idle
timer?

Also, here is some lines from "debug ip". Am I correct in my
assessment of what this traffic is? (I masked my box's assigned ip
address, and this is a small sample.)

6d01h: IP: s=67.27.117.109 (BRI0), d=xxx.xxx.xxx.xxx (BRI0), len 92,
rcvd 3
6d01h: IP: s=xxx.xxx.xxx.xxx (local), d=67.27.117.109 (BRI0), len 92,
sending
6d01h: IP: s=209.178.129.63 (BRI0), d=xxx.xxx.xxx.xxx (BRI0), len 574,
rcvd 3
6d01h: IP: s=xxx.xxx.xxx.xxx (local), d=209.178.129.63 (BRI0), len 56,
sending
6d01h: IP: s=209.178.129.63 (BRI0), d=xxx.xxx.xxx.xxx (BRI0), len 574,
rcvd 3
6d01h: IP: s=67.28.98.149 (BRI0), d=xxx.xxx.xxx.xxx (BRI0), len 92,
rcvd 3
6d01h: IP: s=xxx.xxx.xxx.xxx (local), d=67.28.98.149 (BRI0), len 92,
sending
6d01h: IP: s=67.28.98.149 (BRI0), d=xxx.xxx.xxx.xxx (BRI0), len 48,
rcvd 3
6d01h: tcp0: I LISTEN 67.28.98.149:4279 xxx.xxx.xxx.xxx:135 seq
1879181675
OPTS 8 SYN WIN 8760
6d01h: IP: s=xxx.xxx.xxx.xxx (local), d=67.28.98.149 (BRI0), len 40,
sending
6d01h: IP: s=67.28.98.149 (BRI0), d=xxx.xxx.xxx.xxx (BRI0), len 48,
rcvd 3
6d01h: tcp0: I LISTEN 67.28.98.149:4279 xxx.xxx.xxx.xxx:135 seq
1879181675
OPTS 8 SYN WIN 8760
6d01h: IP: s=xxx.xxx.xxx.xxx (local), d=67.28.98.149 (BRI0), len 40,
sending
6d01h: IP: s=67.28.98.149 (BRI0), d=xxx.xxx.xxx.xxx (BRI0), len 48,
rcvd 3
6d01h: tcp0: I LISTEN 67.28.98.149:4279 xxx.xxx.xxx.xxx:135 seq
1879181675
OPTS 8 SYN WIN 8760
6d01h: IP: s=xxx.xxx.xxx.xxx (local), d=67.28.98.149 (BRI0), len 40,
sending


Thank you for any help and pointers.

"TKM" <> wrote in message
news: m...
> I have an 804 and it has been working fine. However, I recently
> switched ISPs and have noticed a problem.
>
> It appears that my box is being "pinged/accessed" quite frequently by
> machines from outside. I am running NAT, so nothing is getting
> through, but the activity is keeping the line up.
>
> How would I set up a filter that would ignore this traffic when coming
> unrequested from the other side as valid line activity for the idle
> timer?
>
> Also, here is some lines from "debug ip". Am I correct in my
> assessment of what this traffic is? (I masked my box's assigned ip
> address, and this is a small sample.)
>
[cut]

Summary: pings, and connections to port 135... viruses still active. Deny
that incoming traffic and you should be ok.

Ivan