wow connectivity question

[sophiaserpentia]

We've been having problems in the house staying connected to WoW.

Just now, i was booted off, and Norton Firewall told me my computer was under attack, with a pattern that fit the "NMAP XMAS SCAN." I have the IP address of the computer that was trying to do this. But now, i can't get back onto Scarlet Crusade, though i seem to have no trouble getting onto Shadowsong. It doesn't give me an error or a place in queue, it just goes back to the server selection screen without comment.

Has anyone who plays WoW had any problems with the Firewall mistaking WoW for a Trojan Horse?

Comments

[xxshamelessxx.livejournal.com]

i've never had that problem. tomorrow i'll ask my boyfriend, who is a total geek, if he's heard of this happening or if he knows how to fix it.

[lassiter.livejournal.com]

Yuo do have to set a hardware firewll to allow the ports that WoW uses. A software firewall like Zone Alarm can just be set to allow the program to access the internet but a hardware router needs special port permissions set.

My admin page for the WoW ports looks like this - the names are arbitrary assignments but the port numbers are what you have to allow both source and destination access for:


Allow WoW A *,* *,* TCP,8086-8087
Allow WoW Downloader 3 *,* *,* TCP,6112
Allow WoW Downloader 2 *,* *,* TCP,6881-6999
Allow WoW Downloader 1 *,* *,* TCP,3724
Allow WoW B *,* *,* TCP,9081
Allow WoW C *,* *,* TCP,9090
Allow WoW D *,* *,* TCP,9097
Allow WoW E *,* *,* TCP,9100

[sophiaserpentia.livejournal.com]

There are instructions on the WoW webpage for doing this with my firewall... and as far as i can tell i have all of the ports set up properly. I wonder what could be going on?

[xxshamelessxx.livejournal.com]

oh! i also suggest posting to worldofwarcraft and asking around there. the community is very active and helpful.

[sophiaserpentia.livejournal.com]

If it keeps up, i'll write there to ask. Otherwise, that looks like a good community to lurk in.

[sophiaserpentia.livejournal.com]

One would think that this would be designed to work within the firewall constraints... but it's a possibility.

Coincidence?

[neosis.livejournal.com]

It sounds more like the Scarlet Crusade server crashed, and if you have the IP of the computer that was scanning you, you should use a "Reverse DNS Lookup" to find out if it's a blizzard server or not. If it isn't it's coincidence that someone was scanning your computer when the server crashed, if it is, then your Firewall is misbehaving.

Re: Coincidence?

[sophiaserpentia.livejournal.com]

I'll try that when i get back home. I'm inclined to think that it is exactly what my firewall said it was, an attempt by some script kiddie to access my computer (i've seen rumors that there's been a rash of this on LJ), but the strange behavior in WoW made me wonder if it might just be WoW not getting along with my firewall.

[chimpstop.livejournal.com]

It's also possible some one decided to fuck with you. It happens. The world is full of bored 13-17 year old techy boys with nothing better to do.

[sophiaserpentia.livejournal.com]

I've seen rumors that there have been a rash of attacks like this on LJ, attempts to hack people's password info and such.

[chimpstop.livejournal.com]

Sounds more like a denial of service attack. Either random (unlikely) or some one who wanted to fuck up your game play (you being the household) and either had the skills and the pc zombies out there or had a bud with those resources.

Are you hip to Gibson research? He's my favorite info source out there for internet security issues...he wrote the ORIGINAL white paper on how DOS attacks work...which lead the hacker and phreak community to bombard his router into submission for two weeks, until he found a way around the attack.

www.grc.com

I think he's also the invetor of Spinrite.

Been using Shields up to test firewalls for years.

He also turned me on to AntiSpyware five years ago, and I became the Kassandra to his Voice Crying in the wilderness over that security issue.

[sophiaserpentia.livejournal.com]

A reverse DNS reveals the owner of the IP as Blizzard Entertainment. So, yeah, it was a WoW server after all.

[azaz-al.livejournal.com]

Also, sometimes one of the servers is brought down for a time. I hadn't read this when I talked to you this morning, but if it brought you to that screen when you logged on it is likely they had to bring Scarlet Crusade down. The "NMAP XMAS SCAN" doesn't sound like anything associated with WoW. I did see a message up last night that indicated certain realms wer whaving difficulties and they were working to fix it.
The other connectivity problem hopefully was solved by you finding that loose cable.

[sophiaserpentia.livejournal.com]

My impression was that the message from Blizzard refered to general problems, i.e., the long wait time that people have had during certain parts of the day.

[azaz-al.livejournal.com]

No, that's not what they mean. The screen you describe comes up when the server you were using last time you were logged on has been taken down for maintenance.

[sophiaserpentia.livejournal.com]

A reverse DNS reveals the owner of the IP as Blizzard Entertainment. So, yeah, it was a WoW server after all.

I've been getting booted off during peak hours. But i think that is just crashing for lack of memory... to be fixed very soon. :-D

[azaz-al.livejournal.com]

Yay RAM!

OT

[queenofhalves]

just wanted to make sure you saw this. would you pass it on anywhere you think is appropriate?

http://queenofhalves.livejournal.com/718203.html