Action

Select the action that the rule should take if all the criteria are met. Your options are:

Permit | Allow communication of this type to take place.
Block | Prevent communication of this type from taking place.
Monitor | Update the Event Log each time that communication of this type takes place. This option lets you monitor how often this rule is used.


Signature Exclusions

In some cases, benign network activity may appear similar to an attack signature. If you receive repeated warnings about possible attacks, and you know that these warnings are being triggered by safe behavior, you can create an exclusion for the attack signature that matches the benign activity.

To exclude signatures

  • In the Signature Exclusions dialog box, uncheck the box next to the signatures that you want to exclude, and then click OK.

    Each exclusion that you create leaves your computer vulnerable to attacks.


Program Control

Choose one of the available options for the selected program:

Automatically configure Internet access | This is the recommended choice.
Permit this program to access the Internet | This is not as safe as choosing Automatic, but it is appropriate for many programs that are not recognized. If you recognize the program and trust it to be safe, select this option.
Block this program from accessing the Internet | Select this option if you don't recognize the program and the risk is high.
Customize Internet access for this program | Select this option if you understand how the program accesses the Internet and you want to create specific rules to control its access.


Communications

Select the protocols for the rule. Your options are:

TCP | The rule applies to TCP (Transmission Control Protocol) communications.
UDP | The rule applies to UDP (User Datagram Protocol) communications.
TCP and UDP | The rule applies to both TCP and UDP communications.
ICMP | The rule applies to ICMP (Internet Control Message Protocol) communications. This option is available only when you add or modify a General rule.
ICMPv6 | The rule applies to ICMP (Internet Control Message Protocol for Internet Protocol version 6) communications.
All | The rule applies to all supported protocols.

For UDP communications, the rule analyzes the first datagram only. If the rule applies, the same action (permit, block, or monitor) is used for all subsequent UDP datagrams that flow in either direction between the same endpoints.

Select the appropriate ports for the rule. Your options are:

All types of communications (all ports) | The rule applies to communications that use any port.
Only the types of communications or ports listed below | The rule applies to the ports that are listed. You can add ports to, or remove ports from, the list.


Computers

Select the computers that apply to the rule. Your options are:

Any computer | The rule applies to all computers.
Only the computers or sites listed below | The rule applies only to the computers, sites, or domains that are listed.


Connections

Select the type of connection for the rule. Your options are:

Connections to other computers | The rule applies to outbound connections from your computer to another computer.
Connections from other computers | The rule applies to inbound connections from another computer to your computer.
Connections to and from other computers | The rule applies to both inbound and outbound connections.


Description

Choose a description for this rule. Since some communications require multiple rules, you should enter a specific description.


Specify Computers

The Specify Computers dialog box lets you specify computers in three ways:

  • individual computers

  • a range of computers

  • all computers on a subnet

In each of these three you can use IP addresses to identify computers.

To specify an individual computer

  1. In the dialog box, click Individually.

  2. Type the name or IP address of a single computer.

  3. Click OK.

To specify a range of computers

  1. In the dialog box, click Using a range.

  2. In the Starting Internet Address text box, type the starting (lowest numerically) IP address.

  3. In the Ending Internet Address text box, type the ending (highest numerically) IP address.

  4. Click OK.

To specify computers using a network address

  1. In the dialog box, click Using a network address.

  2. In the Network Address text box, type the IP address of a computer on the subnet.

  3. In the Subnet Mask text box, type the subnet mask.

    The appropriate subnet mask is almost always 255.255.255.0.

  4. Click OK.

More Information

Finding a computer's IP address


Specify ICMP Commands

If you are creating a General rule, you can specify special categories of commands for ICMP communication. The categories are:

Known commands from list | The rule applies to the selected commands in the list. Check each command to which you want this rule to apply.
Individually specified commands | The rule applies to the commands that you enter. You can enter multiple port numbers separated by spaces.
Command range | The rule applies to a series of commands. Enter the starting command and the ending command.


Specify Ports

If you are creating a General rule, you can specify the methods of communication, or ports, to which this rule applies. The categories are:

Known ports from list | The rule applies to the selected ports in the list. Check each port to which you want this rule to apply.
Individually specified ports | The rule applies to the ports that you enter. You can enter multiple port numbers separated by spaces.
Port range | The rule applies to a series of ports. Enter the starting (lowest) port number and the ending (highest) port number.
Locality | This rule can be applied to local and remote ports. Local ports are those on your computer that are usually used for inbound connections. Remote ports are on the computer with which your computer is communicating. They are usually used for outbound connections.


Rule Summary

Shows the rules for the category in which you are working. The categories are:

General rules | There is one list of General rules.
Program rules | Each program has its own list of rules.


Tracking

Select if and how you want to track the rule. Your options are:

Create an Event Log entry | An entry is created in the Event Log when a network communication event matches this rule.
Only log event after it occurs X times | Control when to begin logging network communication that matches this rule.


Action

Slect the action that the rule should take if all criteria are met. Your options are:

Permit | Allow communication of this type to take place.
Block | Prevent communication of this type from taking place.


Connections

Select the type of connection for the rule. Your options are:

Connections from other computers

The rule applies to inbound connections from another computer to your computer.


Tracking

Select if and how you want the rule to be tracked. Your options are:

Create an Event Log entry | An entry is created in the Event Log when a network communication event matches this rule.
Only log event after it occurs X times | Control when to begin logging network communication that matches this rule.


Security Alert - Internet Worm Protection Alert

Norton Internet Worm Protection scans all the network traffic that enters and exits your computer and compares this information against a set of attack signatures, arrangements of information that identify an attacker's attempt to exploit a known operating system or program vulnerability.

If the information matches an attack signature, Internet Worm Protection automatically discards the packet and severs the connection with the computer that sent the data. This protects your computer from being affected in any way. The Security Alert informs you of the attempted attack, and provides you the option to suppress further alerts for this threat.

Norton Internet Worm Protection provides information about the alert. By scrolling in the Security alert's information box, you can view details about the attack. The categories include the following:

Intrusion | Name of the intrusion that is detected
Intruder IP | The IP address or name of the machine that attempted to attack you
Risk level | Levels can be low, medium, and high
Protocol | Internet protocol that is used by the attacker (TCP, UDP, or ICMP)
Attacked IP | IP address on your computer. In most cases a machine has one IP address, but for machines with multiple network-interface cards, this field is important to determine which network segment delivered this attack
Attacked port | Port number on your machine that was attacked

Internet Worm Protection relies on an extensive list of attack signatures to detect and block suspicious network activity. Run LiveUpdate regularly to ensure that your list of attack signatures is up to date.


Program Control Alert - IP Traffic Alert

Norton Internet Worm Protection may issue a Program Control alert based on an IP event. An IP event occurs when Norton Internet Worm Protection detects program traffic to an open port, but does not recognize the program.

Before the Program Control alert, based on an IP event, is issued, the program is scanned for viruses. If no virus is detected, and the program is unrecognized, and if a rule does not exist to control the program's access to the Internet, Norton Internet Worm Protection issues a Program Control alert. The alert provides the following information about the event:

Date | Date in which the alert occurred
Time | Time in which the alert occurred
Path | Full path to the program that triggered the alert
File name | Full path to the program that triggered the alert
Direction | Direction of the attack
Local address | Internet Protocol Address of the attack. If the address is 0.0.0.0, the attack took place on all local network adapters
Local port | Local port number of the attack
Remote address | Remote Internet Protocol Address of the attacker; if unknown, this field is not shown
Remote port | Remote port of the attacker; if unknown, this field is not shown.
Protocol | Protocol used in the event (TCP, UDP, ICMP, or IP)

The Program Control alert also requires you to make a decision about the event. Your options are:

Permit | Permit inbound Internet traffic to your program. If you recognize the program and trust it to be safe, select this option. Internet Worm Protection creates a Permit rule for this program.
Block | Block inbound Internet traffic to your program. Select this option if you do not recognize the program and the risk is high. Internet Worm Protection creates a Block rule for this program.

Internet Worm Protection relies on an extensive list of signatures to detect and block suspicious network activity. Run LiveUpdate regularly to ensure that your list of attack signatures is up to date.


Program Control Alert - Listen Alert

Internet Worm Protection detects programs, such as Web servers and multi-player games, that open ports to listen for connections from other computers. If an automatic scan of the program does not detect a virus, and if a rule does not exist to control inbound access to a program, Internet Worm Protection issues a Program Control alert. The alert provides the following information about the event:

Security rule | Name of the program rule
Date | Date in which the alert occurred
Time | Time in which the alert occurred
Path | Full path to the program that triggered the alert
File name | File name of the program that triggered the alert
Direction | Direction of the attack
Local address | Internet Protocol Address of the attack. If the address is 0.0.0.0, the attack took place on all local network adapters
Local port | Local port number of the attack
Protocol | Protocol used in the event (TCP, UDP, ICMP, or IP)

The Program Control alert also requires you to make a decision about the event. Your options are:

Permit | Permit inbound Internet traffic to access your program. If you recognize the program and trust it to be safe, select this option. Internet Worm Protection creates a Permit rule for this program.
Block | Block inbound traffic from accessing the program. Select this option if you do not recognize the program and the risk is high. Internet Worm Protection creates a Block rule for this program.

Internet Worm Protection relies on an extensive list of signatures to detect and block suspicious network activity. Run LiveUpdate regularly to ensure that your list of attack signatures is up to date.


About the Rules window

In this window, you can create and customize rules using the following buttons that appear below the list:

Add | Click Add to open the Add Rule wizard. Follow the instructions in the wizard to create a rule.
Modify | Click a rule and then click Modify to open the Modify Rule window. Use the tab pages in that window to change the properties of the rule.
Remove | Click a rule and then click Remove to delete the rule from the list.
Move Up/Move Down | Click a rule and then click Move Up or Move Down to change the position of the rule in the list. Rules that appear higher in the list override rules that appear lower in the list.

You can also disable a rule by unchecking its check box.