Wingate Firewall issues/questions

[compuzed]

IP Blackhole - Notify option. How does this notify when that IP hits the firewall ? Is it by email., or a system message. The Help file has nothing.

Also, I am looking for a resource that explains what the different ports are ie. when IP source 22.22.22.22 hits port 4354; what does that mean? Is it a trojan trying to sneak into my britches??

also, is there a way to tell the Firewall only to record the source and port of activity, and then be able later to pull the log file and find out that 10% of the activity aimed at the firewall was from so and so IP address, so that you can blackhole the IP. It is nice to see blocked activity, but a more proactive approach I think is called for......

Rick
Compuzed Computers Corp

[genie]

Blackhole notification forces Wingate to not only ignore traffic from this particular IP, but also log any attempt originated form this IP address.

Port distribution is somewhat difficult to explain off-hands. There are certain ports which are considered standard for the certain applications, like port 80 is an HTTP port, port 23 is telnet, 21 is ftp, etc. For the port list take a look at <windows directory>/system32/drivers/etc/services file or just look up a particular port info on google/any search engine you prefer. Wingate log file can contain some non-breakin-related entries, like connection traits.