See “Keeping current with LiveUpdate” on page 53.
Guarding against intrusion attempts 71
How Norton Personal Firewall protects against network attacks
Because attacks may span packets, Intrusion Detection examines packets in two different ways. It scans each packet individually looking for patterns that are typical of an attack. It also monitors the packets as a stream of information, which lets it identify attacks spread across multiple packets.
If the information matches a known attack, Intrusion Detection automatically discards the packet and severs the connection with the computer that sent the data. This protects your computer from being affected in any way.
You can modify how Intrusion Detection responds to attacks by excluding attack signatures from being monitored and by enabling or disabling AutoBlock, which automatically blocks all communication with an attacking computer. By excluding certain network behavior from blocking, you can continue to be productive, even while your computer is under attack.
Along with protecting your computer against attacks, Norton Personal Firewall also monitors all of the information that your computer sends to
other computers. This ensures that your computer cannot be used to attack other users or be exploited by zombies.If Norton Personal Firewall detects
that your computer is sending information that is typical of an attack, it immediately blocks the connection and warns you about the possible problem.
To reduce the number of warnings that you receive, Norton Personal Firewall only monitors attacks that are targeted at ports that your computer uses. If an attacker attempts to connect to your computer via an inactive port or a port that has been blocked by the firewall, Norton Personal Firewall will not notify you because there is no risk of an intrusion.
Norton Personal Firewall does not scan for intrusions by computers in your Trusted Zone. However, Intrusion Detection does monitor the information that you send to Trusted computers for signs of zombies and other remote control attacks.
Intrusion Detection relies on an extensive list of attack signatures to detect and block suspicious network activity. Run LiveUpdate regularly to ensure that your list of attack signatures is up to date.
Visual Tracking locates attackers
See “Identify the source of communications” on page 43.
Norton Personal Firewall now includes Visual Tracking, which lets you get information about the IP address used for a particular connection. This can help you identify the source of an attack.
