Index  | Recent Threads  | Unanswered Threads  | Who's Active  | Guidelines  | Search
 

Quick Go »
No member browsing this thread
Thread Status: Active
Total posts in this thread: 6
[ Jump to Last Post ]
Post new Thread
Author
Previous Thread This topic has been viewed 1048 times and has 5 replies Next Thread
Former Member
Cruncher
Joined: May 22, 2018
Post Count: 0
Status: Offline
Reply to this Post  Reply with Quote 
New firewall alerts

I switched firewalls not too long ago. Recently, the new firewall has twice alerted on Internet access requests. The second source, similar to the first, is wcg_c4cw_lmps_6.41_windows_x86_64. The destination IP in both cases is 224.0.0.22 (which is reserved for multicast). I don't see any messages in the BOINC client that appear to relate to these alerts.

The wcg_ prefix makes me think to look here. The Computing for Clean Water project uses c4cw_. I do allow this project.

Google doesn't seem to have any authoritative references on this process.

Do I have a problem? Do others get this firewall alert?

Thanks!
[Oct 6, 2011 12:41:00 PM]   Link   Report threatening or abusive post: please login first  Go to top 
PMH_UK
Veteran Cruncher
UK
Joined: Apr 26, 2007
Post Count: 787
Status: Offline
Project Badges:
Reply to this Post  Reply with Quote 
Re: New firewall alerts

I think this is related to security certificates.

From a WHOIS resource:
http://whois.domaintools.com/224.0.0.22
shows "reserved for multicast" and clicking HOST link reveals assigned to VeriSign.

Paul.
----------------------------------------
Paul.
[Oct 6, 2011 1:05:50 PM]   Link   Report threatening or abusive post: please login first  Go to top 
Former Member
Cruncher
Joined: May 22, 2018
Post Count: 0
Status: Offline
Reply to this Post  Reply with Quote 
Re: New firewall alerts

What brand FW is this, what release and what's the exact message?

See no association of that IP and WCG. The host does occasionally check the quality of the network connection per help: http://www.worldcommunitygrid.org/help/viewSearch.do?searchString=scan but why that particular IP would be taken as vehicle, techs would have to elucidate.

Should anything try to piggy-back in with the WCG workunits, there are checks and encryptions, which would cause the files to be removed as invalid.

--//--
[Oct 6, 2011 1:50:58 PM]   Link   Report threatening or abusive post: please login first  Go to top 
Former Member
Cruncher
Joined: May 22, 2018
Post Count: 0
Status: Offline
Reply to this Post  Reply with Quote 
Re: New firewall alerts

I'm using ZoneAlarm's freeware firewall. I have since dismissed the alert. It was ZoneAlarm's standard "a program is seeking access to the internet".

Program name: wcg_c4cw_lmps_6.41_windows_x86_64
Destination: 224.0.0.22

The previous incident, maybe 1 month ago, specified program:
wcg_c4cw_lmps_6.13_windows_intelx86

Given the defenses built into the WCG workunits, should I assume that one of these is true?

  • either I have a rogue program masquerading as a WCG workunit angry , or
  • the C4CW project incorporates reporting to the 224.0.0.22 IP straight face


The BOINC client identifies 4 active tasks, one each for projects

  • Human Proteome Folding - Phase 2 6.40
  • Computing for Clean Water 6.41
  • The Clean Energy Project - Phase 2 6.40
  • FightAIDS@Home 6.40

The C4CW project report deadline is today.

Windows Vista 64-bit shows 5 WCG tasks:

  • wcgrid_cep2_qchem_6.40_windows_intelx86 *32
  • wcgrid_cep2_6.40_windows_intelx86 *32
  • wcg_hpf2_rosetta_6.40_windows_intelx86 *32
  • wcg_faah_autodock_6.40_windows_intelx86 *32
  • wcg_c4cw_lmps_6.41_windows_x86_64

[Oct 6, 2011 2:33:09 PM]   Link   Report threatening or abusive post: please login first  Go to top 
Former Member
Cruncher
Joined: May 22, 2018
Post Count: 0
Status: Offline
Reply to this Post  Reply with Quote 
Re: New firewall alerts

Well, I googled on the combo ZA+224.0.0.22 and there were a bunch of hits, such as this: http://www.tek-tips.com/viewthread.cfm?qid=994892&page=784. It's likely never to get outside of your (W)LAN.

--//--
[Oct 6, 2011 2:49:08 PM]   Link   Report threatening or abusive post: please login first  Go to top 
Former Member
Cruncher
Joined: May 22, 2018
Post Count: 0
Status: Offline
Reply to this Post  Reply with Quote 
Re: New firewall alerts

Thanks, SekeRob.
[Oct 6, 2011 3:39:36 PM]   Link   Report threatening or abusive post: please login first  Go to top 
[ Jump to Last Post ]
Post new Thread