Should I let this NTL IP address through?

I am on NTL. What exactly is incoming IP address 80.7.172.78 trying
to do?

Sandi

------

DETAILS:

For about one day my Sygate firewall was trapping incoming contact
from that IP address 80.7.172.78 and sometimes flagging the contact
as "major" and sometimes as "minor".

Sometimes the contact was by TCP but most times there was no protocol
recorded. It did not try repeatedly if it doesn't get through but
just tried once.

I am on NTL and that IP address resolves to NTL but exactly what is
it address trying to do? S

descr: NTL-UK-IP-BLOCK
origin: AS5089
mnt-by: AS5089-MNT
changed: (E-Mail Removed) 20040929
source: RIPE

role: NTLI Network Management Centre
address: NTL Internet
address: Crawley Court
address: Winchester

"Sandi" <(E-Mail Removed)> wrote in message
news:962E60491E7574C1H4@62.253.162.203...
>I am on NTL. What exactly is incoming IP address 80.7.172.78 trying
> to do?
>
> Sandi
> ------
> DETAILS:
>
> For about one day my Sygate firewall was trapping incoming contact
> from that IP address 80.7.172.78 and sometimes flagging the contact
> as "major" and sometimes as "minor".
>
> Sometimes the contact was by TCP but most times there was no protocol
> recorded. It did not try repeatedly if it doesn't get through but
> just tried once.
>
> I am on NTL and that IP address resolves to NTL but exactly what is
> it address trying to do? S
>
> descr: NTL-UK-IP-BLOCK
> origin: AS5089
> mnt-by: AS5089-MNT
> changed: (E-Mail Removed) 20040929
> source: RIPE
>
> role: NTLI Network Management Centre
> address: NTL Internet
> address: Crawley Court
> address: Winchester

80.7.172.78 traced to: cpc1-seve3-3-0-cust78.popl.cable.ntl.com

Sandi wrote:
> I am on NTL. What exactly is incoming IP address 80.7.172.78 trying
> to do?
>
> Sandi
>
> ------
>
> DETAILS:
>
> For about one day my Sygate firewall was trapping incoming contact
> from that IP address 80.7.172.78 and sometimes flagging the contact
> as "major" and sometimes as "minor".
>
> Sometimes the contact was by TCP but most times there was no protocol
> recorded. It did not try repeatedly if it doesn't get through but
> just tried once.
>
> I am on NTL and that IP address resolves to NTL but exactly what is
> it address trying to do? S
>
> descr: NTL-UK-IP-BLOCK
> origin: AS5089
> mnt-by: AS5089-MNT
> changed: (E-Mail Removed) 20040929
> source: RIPE
>
> role: NTLI Network Management Centre
> address: NTL Internet
> address: Crawley Court
> address: Winchester

Do you have the port number 80.7.172.78 is trying to connect to ?
Without that its only possible to make wild guesses as to what its
trying to do. As to whether or not to let it through - don't!!

B.

On Mon 04 Apr 2005 10:31:12, buzzbomb wrote:
<news:AP74e.8750$(E-Mail Removed)>

> Sandi wrote:
>> I am on NTL. What exactly is incoming IP address 80.7.172.78
>> trying to do?
>>
>> Sandi
>>
>> ------
>>
>> DETAILS:
>>
>> For about one day my Sygate firewall was trapping incoming
>> contact from that IP address 80.7.172.78 and sometimes flagging
>> the contact as "major" and sometimes as "minor".
>>
>> Sometimes the contact was by TCP but most times there was no
>> protocol recorded. It did not try repeatedly if it doesn't get
>> through but just tried once.
>>
>> I am on NTL and that IP address resolves to NTL but exactly
>> what is it address trying to do? S
>>
>> descr: NTL-UK-IP-BLOCK
>> origin: AS5089
>> mnt-by: AS5089-MNT
>> changed: (E-Mail Removed) 20040929
>> source: RIPE
>>
>> role: NTLI Network Management Centre
>> address: NTL Internet
>> address: Crawley Court
>> address: Winchester
>
> Do you have the port number 80.7.172.78 is trying to connect to
> ? Without that its only possible to make wild guesses as to what
> its trying to do. As to whether or not to let it through -
> don't!!

Don't have the port numbers. They are no longer in the logs.

"Brax" <(E-Mail Removed)> wrote in news:d2qtv7$1p5$3
@newsg4.svr.pol.co.uk:

> 80.7.172.78 traced to: cpc1-seve3-3-0-cust78.popl.cable.ntl.com

Looks like just another customer machine so no point in letting it
through.
If everything is working fine then there's no need to open your computer
up.

--
Colin
*Drop DEAD from the email address to reply*

Sandi wrote:
> On Mon 04 Apr 2005 10:31:12, buzzbomb wrote:
> <news:AP74e.8750$(E-Mail Removed)>
>
>>Sandi wrote:
>>
>>>I am on NTL. What exactly is incoming IP address 80.7.172.78
>>>trying to do?
>>>
>>>Sandi
>>>
>>>------
>>>
>>>DETAILS:
>>>
>>>For about one day my Sygate firewall was trapping incoming
>>>contact from that IP address 80.7.172.78 and sometimes flagging
>>>the contact as "major" and sometimes as "minor".
>>>
>>>Sometimes the contact was by TCP but most times there was no
>>>protocol recorded. It did not try repeatedly if it doesn't get
>>>through but just tried once.
>>>
>>>I am on NTL and that IP address resolves to NTL but exactly
>>>what is it address trying to do? S
>>>
>>>descr: NTL-UK-IP-BLOCK
>>>origin: AS5089
>>>mnt-by: AS5089-MNT
>>>changed: (E-Mail Removed) 20040929
>>>source: RIPE
>>>
>>>role: NTLI Network Management Centre
>>>address: NTL Internet
>>>address: Crawley Court
>>>address: Winchester
>>
>>Do you have the port number 80.7.172.78 is trying to connect to
>>? Without that its only possible to make wild guesses as to what
>>its trying to do. As to whether or not to let it through -
>>don't!!
>
>
> Don't have the port numbers. They are no longer in the logs.
With no port number it could be anything from a deliberate malicious
crack attempt, to a trojan on the other guys machine to some P2P app
attempting to connect to an old cached address.

As a general rule NEVER allow anything to connect to you computer unless
you know what it it, where/who it comes from and are expecting it.

B.

"cw" <(E-Mail Removed)> wrote in message
news:Xns962EC36E6DB15cwfidei@212.159.2.85...
> "Brax" <(E-Mail Removed)> wrote in news:d2qtv7$1p5$3
> @newsg4.svr.pol.co.uk:
>
> > 80.7.172.78 traced to: cpc1-seve3-3-0-cust78.popl.cable.ntl.com
>
> Looks like just another customer machine so no point in letting it
> through.

Unless you are running a P2P package such as KazaLite, Morpheus, WinMX or
using an IP telepony service, or running some kind of server, but in general
for web surfing, POP e-mail, usenet news etc you don't need allow in bound
connects.

> If everything is working fine then there's no need to open your computer
> up.
>
> --
> Colin
> *Drop DEAD from the email address to reply*