Zone Alarm alerts for BitComet port hours after shutting down BC

[junkiebob]

Hi guys,

I have an issue I can't resolve concerning Zone Alarm in combination with BitComet. I've searched everwhere, read the FAQ's, searched the forums, but I can't really find anything about this issue. I've been using BitComet for quite a long time, but recently I installed Zone Alarm Pro (version: 6.5.700.000) which resulted in massive amounts of alerts for the BitComet port, hours after closing BitComet. So everything works fine, torrent's, download / upload speeds are all right.

But when I shut down BitComet, I keep getting firewall alerts in Zone Alarm mainly of the following kind: TCP (flags: S) towards my IP including the port used by BitComet. Now if this keeps up maybe 5 min after shutting down BitComet, ok, but this goes on hours and hours. When I turn on the computer the next day, people are still continuously trying to connect to my computer at that BitComet port.

There are no other 'intruder attempts', I use ZoneAlarm firewall, AVG Free virus scanner, Ad-aware, Spybot & HijackThis and my computer is completely clean (and working like a charm).

My question is: How can I stop this massive amount of people trying to reach me hours after closing BC? Is there anything I can do about this by changing settings or something?

Thanks a lot for your time and effort! :)

[bitdave]

There isnt too much you can do. After you close Bitcomet other peers will continue to try to connect to you. It isnt anything malicious, they just want you back in the swarm.

The problem is with ZoneAlarm. Since ZA is application based as soon as you exit the Bitcomet application ZA will no longer forward incoming requests, instead it will send back a closed or stealth response and the other peers will continue to try to connect to you since they get no response from Bitcomet.

One way to minimize this is when you want to exit Bitcomet, first stop all the torrents you have running. Now since Bitcomet is still open ZA will continue to pass the incoming requests unhindered and Bitcomet will be able to tell all the other peers that you've have stopped your torrent. Download this program and you can watch as the peers start to disconnect, when they are all gone then you can exit Bitcomet.

Another way to avoid these connection attemps is to change your WAN ip address. This only works if your ISP gives you a dynamic IP address. So just turn off or unplug your DSL/Cable modem and wait for couple of minutes and then plug it back in. The modem will negotiate a new IP address from your ISP and you shouldnt have any more connection attempts.

[junkiebob]

Thanks for your reply bitdave :) I tried your suggestions. Unfortunately I don't think my ISP gives dynamic IP's.

TcpView is a pretty nifty little program and it did give some more info. I can now clearly see all those BitComet connections and see them disappear when I stop the torrent, like you said. When every last one of 'em is gone and I shut down BitComet, there seem to be no 'BitComet-related' connections left. However right from the moment I shut down BC, I still get those alerts. In addition, I tried tweaking connection settings. But this also didn't help, since it's an after-BC-shutdown situation with effectively no connections, only connection attemps.

Do you think leaving BC on longer - without running torrents - will help to send out the message I'm off?

Too bad there is no SIGN OFF button to let the network know you're quiting, of course normally EXIT would be that button. Naturally these alerts are a mere annoyance, rather than a real problem, but I'd like to minimize as much as possible. Cause in a couple of days I already got a whopping 5000 ZA alerts of which probably 99% was due to this BC issue. Thanks :)

In a more general sense, what results in this issue and what is the advantage of such a connection method? I mean, wouldn't signing off people who aren't available any more be a lot more effective? Now a lot of 'connection-space' is lost, when 1 signal from a seeder to a server, would avoid all these hundreds of connection attemps. Don't know much about the technical details of the process though, so maybe I'm talking BS here :D

[kluelos]

It isn't BS, really, just details of how bittorrent works that aren't too clear.

When you connect to the tracker, your scrape message tells it your status and some details. When you start or restart the torrent, it includes a request to join the swarm.

The tracker replies with a list of swarm members, and an interval that your client should wait before scraping the tracker again.

When you stop the torrent, your client sends a message requesting the tracker take you out of the swarm.

All those other swarm members are out there still though, and the last time they scraped the tracker, you were listed as a swarm member. They're all going to continue thinking you are, until they all (successfully) re-scrape the tracker and find out you aren't listed anymore. That can take quite a long time. If their scrapes time out, they'll go on thinking you're in the swarm.

Now the part I'm not clear on is, when do those others actually stop trying to connect with you? Is it when they get the new scrape and you're not listed anymore? Or will some of them still occasionally try to re-contact you (because they were connected to you earlier) until they finally figure you're unresponsive? I suspect it's the latter. It might even be done differently from client to client.

[caf4926]

Hi guys,

I have an issue I can't resolve concerning Zone Alarm in combination with BitComet. I've searched everwhere, read the FAQ's, searched the forums, but I can't really find anything about this issue. I've been using BitComet for quite a long time, but recently I installed Zone Alarm Pro (version: 6.5.700.000) which resulted in massive amounts of alerts for the BitComet port, hours after closing BitComet. So everything works fine, torrent's, download / upload speeds are all right.

But when I shut down BitComet, I keep getting firewall alerts in Zone Alarm mainly of the following kind: TCP (flags: S) towards my IP including the port used by BitComet. Now if this keeps up maybe 5 min after shutting down BitComet, ok, but this goes on hours and hours. When I turn on the computer the next day, people are still continuously trying to connect to my computer at that BitComet port.

There are no other 'intruder attempts', I use ZoneAlarm firewall, AVG Free virus scanner, Ad-aware, Spybot & HijackThis and my computer is completely clean (and working like a charm).

My question is: How can I stop this massive amount of people trying to reach me hours after closing BC? Is there anything I can do about this by changing settings or something?

Thanks a lot for your time and effort! :)

Dude, I notice the same

but I have a hardware firewall

I have a dynamic IP address, so I just power it down for a min and hey presto

so if you have a static IP, all you can do is wait

if your not sure go here http://www.dnsstuff.com/

you IP address is at top right

then disconect and re-connect your modeem/router and then try again

if you are dynamic it will have changed

BUT I guess, if you have a router, you will already know for sure what you are, because you had to set it up

B)

[junkiebob]

Now the part I'm not clear on is, when do those others actually stop trying to connect with you? Is it when they get the new scrape and you're not listed anymore? Or will some of them still occasionally try to re-contact you (because they were connected to you earlier) until they finally figure you're unresponsive? I suspect it's the latter. It might even be done differently from client to client.

Yeah, I think so too, because if everyone stops ONCE they get a new scrape. All right that might take some time, but probably not hours, right? That would mean there are several stages of disconnecting then:

1. Seed disconnects and sends message to tracker

2: Everyone in the swarm keeps connecting UNTIL they get a new listing after re-connecting to tracker

3. Some people KEEP connecting, even if they know I'm not in the list anymore after they re-connected to tracker

Just borrowed some technical terms from you guys there :D Do you think this is what happens?

[kluelos]

You can try manually ditching your IP address. You said, earlier, that you didn't think your ISP gives dynamic addresses, I know. But it almost certainly does. If you want a static IP address, it usually costs a fortune, way more than a casual SOHO broadband connection, because they can't re-use the IP address when you're offline, they have to reserve it just for you 24x7

Check your network connection properties for TCP/IP and see if DHCP is checked. If so, you're dynamic, and can try changing your address manually.

WHen you're ready to shut down, get to a command prompt (Start-> Run -> "CMD" ) then at the prompt, type

"IPCONFIG /RELEASE" (enter) - releases the lease on your dynamic IP address

then type "IPCONFIG /renew" (enter) - renews a lease (gets you another IP address assigned, but no guarantee that it'll be a different one. The might give you the same one again.)

then "exit" (enter) - close the window

and shut down normally. After you're used to it, you can do the release command directly from the RUN prompt. (It will shut the command window immediately if you do that.) then shut down.