Inquiry regarding a particular dialog box which is appearing rather frequently

[spc3rd]

Good afternoon everyone,

I have been observing a particular dialog box (IP Blocklist Report) which seems to be displayed a little too frequently and frankly...I am unsure of just what it means. I've seen it when visiting sites, such as, Bleeping Computer and some others. I would appreciate it very much if some one could enlighten me as to just what it is and its significance. Thank you for your time and any information.

PACKET ALERT.JPG

[jmjsc]

You must have added an IP blocklist. Just go to Alerts in Outpost settings and remove the check mark next to Blocklist IP blocking in the pop up column. That way the blocks still happen, but you won't see it. You still can look in the log files if something you want is blocked.

[spc3rd]

Thanks for the info, jmjsc.

I did as you said. I do have a blocklist which I imported from Blocklist Pro.

[Manny Carvalho]

One way to try and figure out what an imported blocklist is trying to block is to look up the IP address it blocks. Here it's 64.208.138.125.

When you search by IP address, for example here: http://tools.whois.net/whoisbyip/ you find that it is owned by: AppNexus, Inc LVLT-APPNEXUS-APPNE-64-208-136 (NET-64-208-136-0-1) 64.208.136.0 - 64.208.143.25 which coincidentally owns the same name and IP address range as in your blocklist as listed in the popup.

When you search for AppNexus you then find that it's a firm that deals with on line advertising: http://en.wikipedia.org/wiki/AppNexus

Consequently one could conclude that the object of blocking this IP address and that range seems to be a legit whose purpose is for blocking of online ads.

As to why it's being blocked on Bleeping Computer I don't know. Maybe they are serving up ads but it would be best to ask them and see what they say.

And as jmjsc said if the blocking isn't interfering with anything you are doing then you have to rely that the person who put that address on the list has done so for a legitimate purpose. Tracing down everything in an imported blocklist however could become a full time job.

[spc3rd]

Thanks very much for the added info, Manny!

The imported blocklist I have in OPFW came from what Blocklist Pro provides specifically for OPFW users, so I'm guessing they have some valid reason for including it. (Prior to importing the latest updated blocklist from Blocklist Pro, I did not receive these popups before). I did what jmjsc suggested and thusfar...have not been getting any more of those popup alerts.

I have noticed ads on the Bleeping Computer site, BTW.

Thanks again Manny & jmjsc!

[Manny Carvalho]

Ok, but not getting the alert means that you won't know affirmatively something is being blocked. While that's perfectly fine it may mislead you sometime if something doesn't work. Keep that in mind that if something in a web page breaks that you need to look at your logs and see if for some reason the Blocklist is responsible for that. I'm just saying that while alerts like this can be annoying, particularly if a whole bunch are spawned, there's another way to look at them and that is that the firewall is actually doing something and just telling you about it. I just happen to be the kind of guy that appreciates knowing what's going on. I will however, admit that blocking IP addresses is something I don't do because I don't like the frequency of false positives that happen. So, there you go...