Member Avatar for jellybeans27

my problem is that literally every minute i get a pop-up in the bottom right hand corner of my screen saying 'an intrusion attempt has been blocked.' So i click it to find out more and i click 'show details' and it says the intruder is and under source IP address it says '255.255.255.255.This IP address is invalid.' It also says that the destination IP address is 'YOUR-JSAHFDNCU3().' Which is me (my computer name and IP address at that time). What is causing this to happen EVERY SINGLE MINUTE? Please help, Thank you.

  • 2 Contributors
  • 1 Reply
  • 134 Views
  • 8 Hours Discussion Span
  • Latest Post Latest Post by Rueful Rogue

Dani AI

Generated

— the constant popups are a known symptom; ’s note that Norton can suppress that specific signature will stop the noise, but it doesn’t answer why those packets appear. 255.255.255.255 is the IPv4 limited-broadcast address (used locally for things like DHCP/discovery), so the alert usually means your firewall is seeing broadcast or malformed packets and treating them as suspicious.

Quick, practical way to find the root cause: capture and inspect the packets instead of only silencing the alerts. Use a packet capture (Wireshark) on the machine that sees the alerts, reproduce one or two popups, then stop the capture and look for packets involving 255.255.255.255. Useful filters:

capture filter: host 255.255.255.255
display filter: ip.src == 255.255.255.255 || ip.dst == 255.255.255.255

When you find them, check protocol (UDP/ICMP/etc.), source MAC (Ethernet layer), ports, and timing. The source MAC will quickly tell whether the packets originate from your router/modem/local device or from some upstream link. If the MAC belongs to your gateway, update router/modem firmware or reboot it; if it’s from another LAN device, isolate that device and check its network settings.

Other useful steps: temporarily disconnect the router to see if alerts stop (confirms upstream vs. local), update Norton and Windows, run a full malware scan, and check router logs/port forwarding settings. Only exclude the Norton signature as a last resort after verifying the traffic is benign—silencing it without investigation can hide real attacks. If captures show the packets are coming from upstream (not your LAN), contact the ISP with the capture evidence.

Member Avatar for Rueful Rogue

Try this:

Document ID:2002110514573236
Last Modified:09/01/2004


Alert: "NIS (or NPF) has detected...Invalid Source IP Address . . ." after installation

Situation:
After you install Norton Internet Security (NIS) or Norton Personal Firewall (NPF), you see the following security alert every few minutes:

"NIS (or NPF) has detected and blocked an intrusion attempt.
Intrusion: Invalid Source IP Address
Intruder: "

Solution:
This alert indicates that someone may be attempting to attack your computer. Because the message indicates that the attempt was blocked, the attack was not successful.

In some cases, however, it appears that the packets might be from your Internet Service Provider (ISP). If so, then the packet is unlikely to be an attack on your computer, and you can prevent the alerts by disabling the signature of these packets.

To disable the signature:

  1. Open NIS or NPF.
  2. Click Intrusion Detection.
  3. Click Configure. You see the Intrusion Detection dialog box.
  4. Click Signatures. You see the Signatures Exclusions dialog box.
  5. Find and click the signature "Invalid Source IP Address" in the list of signatures.
  6. Click Exclude. NIS or NPF now adds this signature to the list of excluded signatures in the box on the right.

After you follow this procedure, NIS and NPF no longer display "Invalid Source IP Address" alerts.

Why this indicates a possible attack
The alert indicates that someone is sending packet in which the source IP address is invalid. For instance, in the case of the IP address of , the IP address is an administrative number, and not an IP address that is assigned to specific computers. This means that the person sending this packet may be attempting to hide the real source of the packet. It is inappropriate for someone to send such a packet. In specific situations, such a packet could be seen as an attack.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.