Action

Action copyright 2004 Symantec

In the Add Rule window, select the action that you want for this rule. Your options are:

Permit

Allow communication of this type to take place.

Block

Prevent communication of this type from taking place.

Monitor

Update the Event Log or show a message each time that communication of this type takes place. This lets you monitor how often this rule is used.

To monitor a permitted connection, you must create both a monitor and a permit rule. The monitor rule must precede the permit rule.


Action

Action copyright 2004 Symantec

In the Add Rule window, select the action that you want for this rule. Your options are:

Permit | Allow communication of this type to take place.
Block | Prevent communication of this type from taking place.


Connections

Connections copyright 2004 Symantec

Select the type of connection the rule should monitor. Your options are:

Connections to other computers | The rule applies to outbound connections from your computer to another computer.
Connections from other computers | The rule applies to inbound connections from another computer to your computer.
Connections to and from other computers | The rule applies to both inbound and outbound connections.


Connections

Connections copyright 2004 Symantec

Select the type of connection the rule should monitor. Your options are:

Connections from other computers

The rule applies to inbound connections from another computer to your computer.


Computers

Computers copyright 2004 Symantec

Select the computers the rule should monitor. Your options are:

Any computer | The rule applies to all computers.
Only the computers and sites listed below | The rule applies only to the computers, sites, and domains listed.
Adapters | The rule applies to a specific network adapter in your computer. This allows you to customize rules for each of your computer's IP addresses. For example, if your computer is connected to a local network and to the Internet, you might want to set up a rule that permits file sharing on the local network, while another rule blocks file sharing over the Internet.


Computers

Computers copyright 2004 Symantec

Select the computers the rule should monitor. Your options are:

Any computer | The rule applies to all computers.
Only the computers and sites listed below | The rule applies only to the computers, sites, and domains listed.


Communications

Communications copyright 2004 Symantec

Select the protocols the rule should monitor. Your options are:

TCP | The rule applies to TCP (Transmission Control Protocol) communications.
UDP | The rule applies to UDP (User Datagram Protocol) communications.
TCP and UDP | The rule applies to both TCP and UDP communications.
ICMP | The rule applies to ICMP (Internet Control Message Protocol) communications. This option is available only when adding or modifying a General rule.

Select the ports the rule should monitor. Your options are:

All types of communications (all ports) | The rule applies to communications using any port.
Only the types of communications or ports listed below | The rule applies to the ports listed. You can add ports to, or remove ports from, the list.

Communications must match all of a rule's criteria. For example, a rule that blocks communication to and from port 41 will not match a connection attempt from port 80 to port 41. Two rules would be required to block all traffic using that port number‑one for incoming and one for outgoing traffic.


Tracking

Tracking copyright 2004 Symantec

Select if and how you want the rule to be tracked. Your options are:

Only log event after it occurs X times | Control when to begin logging network communication that matches this rule.
Create an Event Log entry | An entry is created in the Event Log when a network communication event matches this rule.
Notify me with a Security Alert | An alert appears when a network communication event matches this rule.


Tracking

Tracking copyright 2004 Symantec

Select if and how you want the rule to be tracked. Your options are:

Only log event after it occurs X times | Control when to begin logging network communication that matches this rule.
Create an Event Log entry | An entry is created in the Event Log when a network communication event matches this rule.


Rule Summary

Rule Summary copyright 2004 Symantec

Shows the rules for the category in which you are working. The categories are:

General rules | There is one list of General rules.
Program rules | Each program has its own list of rules.
Trojan horse rules | These rules are supplied by Symantec and kept current by LiveUpdate. You should not change these rules without specific knowledge of the effect that your changes will have on your protection.


Network Adapters

Network Adapters copyright 2004 Symantec

If you have multiple Ethernet cards or other network adapters on your computer, you can specify the network adapters to which this rule applies. Click Add to add adapters to the list.


Specify Computers

Specify Computers copyright 2004 Symantec

The Specify Computers dialog box lets you specify computers in three ways: individual computers, a range of computers, and all computers on a subnet. In each of these three you can use IP addresses to identify computers.


Specify ICMP Commands

Specify ICMP Commands copyright 2004 Symantec

If you are creating a General rule, you can specify special categories of commands for ICMP communication. The categories are:

Known commands from list | The rule applies to the selected commands in the list. Check each command to which you want this rule to apply.
Individually specified commands | The rule applies to the commands that you enter. You can enter multiple port numbers separated by spaces.
Command range | The rule applies to a series of commands. Enter the starting command and the ending command.


Specify Ports

Specify Ports copyright 2004 Symantec

If you are creating a General rule, you can specify the methods of communication, or ports, to which this rule applies. The categories are.

Filter by | Specifies the methods of communication, or ports, to which this rule applies.
Known ports from list | The rule applies to the selected ports in the list. Check each port to which you want this rule to apply.
Individually specified ports | The rule applies to the ports that you enter. You can enter multiple port numbers separated by spaces.
Port range | The rule applies to a series of ports. Enter the starting (lowest) port number and the ending (highest) port number.
Locality | This rule can be applied to local and remote ports. Local ports are those on your computer that are usually used for inbound connections. Remote ports are on the computer with which your computer is communicating. They are usually used for outbound connections.


Description

Description copyright 2004 Symantec

Choose a description for this rule. Since some communications require multiple rules, you should enter a specific description. If you are creating a Program Rule, you can also choose a category for the rule.


Description

Description copyright 2004 Symantec

Choose a description for this rule. Since some communications require multiple rules, you should enter a specific description.


Location

Location copyright 2004 Symantec

Choose the location or locations that should use this rule. Whenever your computer connects to a network in one of the locations you choose, this rule will be applied.


Program Control

Program Control copyright 2004 Symantec

Choose one of the available options for the selected program.

Automatically configure Internet access | This is usually the best option.
Permit this program to access the Internet | This is not as safe as choosing Automatic, but it is appropriate for many programs that are not recognized. If you recognize the program and trust it to be safe, select this option.
Block this program from accessing the Internet | Select this option if you don't recognize the program and the risk is high.
Customize Internet access for this program | Select this option if you understand how the program accesses the Internet and you want to create specific rules to control its access.


Signature Exclusions

Signature Exclusions copyright 2004 Symantec

In some cases, benign network activity may appear similar to an attack signature. If you receive repeated warnings about possible attacks, and you know that these warnings are being triggered by safe behavior, you can create an exclusion for the attack signature that matches the benign activity.

To exclude a signature

  • Uncheck the box next to it and click OK.
Each exclusion that you create leaves your computer vulnerable to attacks. Be very selective when excluding attacks. Only exclude behavior that is always benign.


Program Control Alert - Listen Alert

Program Control Alert - Listen Alert copyright 2004 Symantec

Internet Worm Protection detects programs, such as Web servers and multiplayer games, that open ports to listen for connections from other computers. If an automatic scan of the program does not detect a virus, and if a rule does not exist to control inbound access to a program, Internet Worm Protection issues a Program Control alert. The alert provides the following information about the event:

Security rule | Name of the program rule
Date | Date in which the alert occurred
Time | Time in which the alert occurred
Path | Full path to the program that triggered the alert
File name | File name of the program that triggered the alert
Direction | Direction of the attack
Local address | Internet Protocol Address of the attack. If the address is 0.0.0.0, the attack took place on all local network adapters
Local port | Local port number of the attack
Protocol | Protocol used in the event (TCP, UDP, ICMP, or IP)

The Program Control alert also requires you to make a decision about the event. Your options are:

Permit | Permit inbound Internet traffic to access your program. If you recognize the program and trust it to be safe, select this option. Internet Worm Protection creates a Permit rule for this program.
Block | Block inbound traffic from accessing the program. Select this option if you do not recognize the program and the risk is high. Internet Worm Protection creates a Block rule for this program.

Internet Worm Protection relies on an extensive list of signatures to detect and block suspicious network activity. Run LiveUpdate regularly to ensure that your list of attack signatures is up to date.


Program Control Alert - IP Traffic Alert

Program Control Alert - IP Traffic Alert copyright 2004 Symantec

Norton Internet Worm Protection may issue a Program Control alert based on an IP event. An IP event occurs when Norton Internet Worm Protection detects program traffic to an open port, but does not recognize the program. This is similar to a listen event, where Norton Internet Worm Protection detects programs, such as Web servers and multiplayer games that open ports to listen for connections from other computers. Norton AntiVirus also issues a Program Control alert following certain listen events.

A Program Control alert that is based on a listen event typically appears before there is an opportunity to issue an alert that is based on an IP event. If this is the case, then you have already selected to permit or block the detected traffic, and there is no reason to issue a subsequent alert when Norton AntiVirus detects a related IP event. However, because a listen event can occur before Norton AntiVirus has begun to run, an event may have taken place undetected. Such a scenario frequently occurs when your computer boots up.

Before the Program Control alert, based on an IP event, is issued, Norton Antivirus performs an automatic scan of the program. If it does not detect a virus, and if it does not recognize the program, and if a rule does not exist to control the program's access to the Internet, Internet Worm Protection then issues a Program Control alert. The alert provides the following information about the event:

Date | Date in which the alert occurred
Time | Time in which the alert occurred
Path | Full path to the program that triggered the alert
File name | Full path to the program that triggered the alert
Direction | Direction of the attack
Local address | Internet Protocol Address of the attack. If the address is 0.0.0.0, the attack took place on all local network adapters
Local port | Local port number of the attack
Remote address | Remote Internet Protocol Address of the attacker; if unknown, this field is not shown.
Remote port | Remote port of the attacker; if unknown, this field is not shown.
Protocol | Protocol used in the event (TCP, UDP, ICMP, or IP)

The Program Control alert also requires you to make a decision about the event. Your options are:

Permit | Permit inbound Internet traffic to your program. If you recognize the program and trust it to be safe, select this option. Internet Worm Protection creates a Permit rule for this program.
Block | Block inbound Internet traffic to your program. Select this option if you do not recognize the program and the risk is high. Internet Worm Protection creates a Block rule for this program.

Internet Worm Protection relies on an extensive list of signatures to detect and block suspicious network activity. Run LiveUpdate regularly to ensure that your list of attack signatures is up to date.


Security Alert - Internet Worm Protection Alert

Security Alert - Internet Worm Protection Alert copyright 2004 Symantec

Norton Internet Worm Protection scans all the network traffic that enters and exits your computer and compares this information against a set of attack signatures, arrangements of information that identify an attacker's attempt to exploit a known operating system or program vulnerability.

If the information matches an attack signature, Internet Worm Protection automatically discards the packet and severs the connection with the computer that sent the data. This protects your computer from being affected in any way. In turn, Norton AntiVirus issues a Security Alert which informs you it has blocked the attack attempt, and provides you the option to suppress further alerts for this threat.

Norton Internet Worm Protection provides information about the alert. By scrolling in the Security alert's information box, you can view details about the attack. The categories include the following:

Intrusion | Name of the intrusion that is detected
Intruder IP | The IP address or name of the machine that attempted to attack you
Risk level | Levels can be low, medium, and high
Protocol | Internet protocol that is used by the attacker (TCP, UDP, or ICMP)
Attacked IP | IP address on your computer. In most cases a machine has one IP address, but for machines with multiple network-interface cards, this field is important to determine which network segment this attack arrived on
Attacked port | Port number on your machine that was attacked

Internet Worm Protection relies on an extensive list of attack signatures to detect and block suspicious network activity. Run LiveUpdate regularly to ensure that your list of attack signatures is up to date.


Security Alert - Trojan Horse Alert

Security Alert - Trojan Horse Alert copyright 2004 Symantec

A Trojan Horse may appear as a useful or benign program. However, a Trojan Horse attack can trigger unauthorized collection, exploitation, falsification, or destruction of data. An attack can provide a backdoor entry to the computer and send important data about your computer out to the Internet.

By default, Internet Worm Protection employs numerous Trojan Horse rules to protect your computer. These rules are supplied by Symantec and kept current by LiveUpdate. You can also create your own rules to guard against Trojan Horse attacks.

When Norton Internet Worm Protection detects a Trojan Horse attack, it issues a Security alert. A Security alert, which informs you of a Trojan Horse attack, is typically generated when a program attempts to open a port for listening, the port is commonly used by Trojan Horse programs, and the port activity matches a program or Trojan Horse rule. Norton AntiVirus issues a Security Alert which informs you it has blocked the Trojan Horse attack attempt, and provides you the option to suppress further alerts for this threat.

Norton Internet Worm Protection provides information about the alert. By scrolling in the Security alert's information box, you can view details about the Trojan Horse attack. The categories include the following:

Security rule | Name of the Trojan Horse or program rule
Date | Date in which the alert occurred
Time | Time in which the alert occurred
Path | Full path to the program that triggered the alert
File name | File name of the program that triggered the alert
Direction | Direction of the attack
Local address | Internet Protocol Address of the attack. If the address is 0.0.0.0, the attack took place on all local network adapters
Local port | Local port number of the attack
Remote address | Remote Internet Protocol Address of the attacker; if unknown, this field is not shown.
Remote port | Remote port of the attacker; if unknown, this field is not shown.
Protocol | Protocol used in the attack (TCP, UDP, ICMP, or IP)