Sygate firewall log

[zver]

Very often i got this blocked ip??Is this mistake,or somethgiung normal..What is all about??
example..
02/15/2004 21:43:00 Blocked 15 Incoming TCP 82.67.231.139 00-06-25-09-CF-22 52738 192.168.1.5 00-40-CA-32-C2-FA 5555 Zoran hjjhjhjhjh ZORAN-5I6R7B1VZ Normal 4 02/15/2004 21:42:23 02/15/2004 21:42:43 Block_all
Somebody tryed to peak in somehow??Any ideas??

 

[LTR12101B]

The address is gw.geo6.net - can't see a site - all the other addrs in that range are proxad.net.

The port number (unconfirmed) seems to be a Unix admin tool.

 

[FortiTude]

there are several programs listed for that port, including napster.
could be the reason if you have a dynamic ip.
more info on that ip:

Final results obtained from whois.ripe.net.
Results:
% This is the RIPE Whois server.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-services/db/copyright.html

inetnum: 82.67.230.0 - 82.67.231.255
netname: FR-PROXAD-ADSL
descr: Proxad / Free SAS
descr: Static pool (Freebox)
descr: bossuet-2 (th2)
descr: NCC#2003105443
country: FR
admin-c: ACP23-RIPE
tech-c: TCP8-RIPE
status: ASSIGNED PA
remarks: Spam/Abuse requests: mailto:abuse@proxad.net
mnt-by: PROXAD-MNT
changed: nhyvernat+ripe@corp.free.fr 20031029
source: RIPE

there are ssh (cisco), ftp (private, proftp) and emule port open
dont thind you have to worry about it
forti

 

[zver]

Thanks for clarification,was just curius..