Which machine responds to a ping?

Would you help straighten out my thinking on my LAN setup as to what device
should respond to a ping plus what IP it would be providing?

I was pinged by three machines in about 45 seconds last night in this
configuration so I'm trying to figure out what is going on. My setup is:

Motorola Cable Modem followed by a Netgear WRN2000 'n' router (firewall
setup) then two machines with only one active at the time of the incident.

Sensing some attempts to gain access to my setup, I added Comodo Firewall
(only) to the laptop in case someone was getting past the router firewall.
Last night Comodo, in a 45 second span, asked to approve, or not, a response
to pinging, then another unit with one number higher in his IP then it
changed to a third ping and it was one number higher.

Since the router has a firewall, my assumption was that the router would
respond to the ping with the WAN-IP assigned by the cable company. (router
log showed nothing regarding the incident)

If that is wrong and the router passes the ping through to my laptop, what
IP WAN or LAN is the response to the outsider?

Either my assumption is wrong or someone is really good at getting through.

What should be happening here? Thanks, Jim

Forgot to mention this is Vista Ultimate on this system.

"jim-g" <##jimg@noname.net> wrote in message
news:O0yY1cDxJHA.1212@TK2MSFTNGP04.phx.gbl...
> Would you help straighten out my thinking on my LAN setup as to what
> device should respond to a ping plus what IP it would be providing?
>
> I was pinged by three machines in about 45 seconds last night in this
> configuration so I'm trying to figure out what is going on. My setup is:
>
> Motorola Cable Modem followed by a Netgear WRN2000 'n' router (firewall
> setup) then two machines with only one active at the time of the incident.
>
> Sensing some attempts to gain access to my setup, I added Comodo Firewall
> (only) to the laptop in case someone was getting past the router firewall.
> Last night Comodo, in a 45 second span, asked to approve, or not, a
> response to pinging, then another unit with one number higher in his IP
> then it changed to a third ping and it was one number higher.
>
> Since the router has a firewall, my assumption was that the router would
> respond to the ping with the WAN-IP assigned by the cable company.
> (router log showed nothing regarding the incident)
>
> If that is wrong and the router passes the ping through to my laptop, what
> IP WAN or LAN is the response to the outsider?
>
> Either my assumption is wrong or someone is really good at getting
> through.
>
> What should be happening here? Thanks, Jim

Hi
If you would look at the Router's log you would see constant Pinging from
the Internet on the WAN Port.
This is a normal "noise at the gate" of the Router and it is very common in
Cable Internet connection.
You have to make sure that the Router is set to discard this Pings, and they
would Not enter to your system.
Look at the Router's manual for how-to.
If it is keeping coming run this free util on each computer to find the
source of the traffic.
http://technet.microsoft.com/en-us/s.../bb897437.aspx
Jack (MS, MVP-Networking)

"jim-g" <##jimg@noname.net> wrote in message
news:O0yY1cDxJHA.1212@TK2MSFTNGP04.phx.gbl...
> Would you help straighten out my thinking on my LAN setup as to what
> device should respond to a ping plus what IP it would be providing?
>
> I was pinged by three machines in about 45 seconds last night in this
> configuration so I'm trying to figure out what is going on. My setup is:
>
> Motorola Cable Modem followed by a Netgear WRN2000 'n' router (firewall
> setup) then two machines with only one active at the time of the incident.
>
> Sensing some attempts to gain access to my setup, I added Comodo Firewall
> (only) to the laptop in case someone was getting past the router firewall.
> Last night Comodo, in a 45 second span, asked to approve, or not, a
> response to pinging, then another unit with one number higher in his IP
> then it changed to a third ping and it was one number higher.
>
> Since the router has a firewall, my assumption was that the router would
> respond to the ping with the WAN-IP assigned by the cable company.
> (router log showed nothing regarding the incident)
>
> If that is wrong and the router passes the ping through to my laptop, what
> IP WAN or LAN is the response to the outsider?
>
> Either my assumption is wrong or someone is really good at getting
> through.
>
> What should be happening here? Thanks, Jim

Thanks Jack, This has been a good re-learning experience for an old timer
who has been away from networking for a long time. Finally was able to
work back to find out the Toshiba laptop was 'calling for updates'.

You can also check the ARP table on the receiving machine. The command to
use is 'arp -a' from the cmd shell.

That will show you the hardware MAC address, mapped to the IP address, of
anything that's tried to connect to it. You could then compare that MAC
info to your other devices on your network. An 'ipconfig /all' cmd on a PC
will tell you it's MAC address. Other equipment like printers or routers
will often have that on a serial number label. The info may shed additional
light on what's connected to your network.

Your question would probably be better asked on a forum for that netgear
equipment.


"jim-g" <##jimg@noname.net> wrote in message
news:O0yY1cDxJHA.1212@TK2MSFTNGP04.phx.gbl...
> Would you help straighten out my thinking on my LAN setup as to what
> device should respond to a ping plus what IP it would be providing?
>
> I was pinged by three machines in about 45 seconds last night in this
> configuration so I'm trying to figure out what is going on. My setup is:
>
> Motorola Cable Modem followed by a Netgear WRN2000 'n' router (firewall
> setup) then two machines with only one active at the time of the incident.
>
> Sensing some attempts to gain access to my setup, I added Comodo Firewall
> (only) to the laptop in case someone was getting past the router firewall.
> Last night Comodo, in a 45 second span, asked to approve, or not, a
> response to pinging, then another unit with one number higher in his IP
> then it changed to a third ping and it was one number higher.
>
> Since the router has a firewall, my assumption was that the router would
> respond to the ping with the WAN-IP assigned by the cable company.
> (router log showed nothing regarding the incident)
>
> If that is wrong and the router passes the ping through to my laptop, what
> IP WAN or LAN is the response to the outsider?
>
> Either my assumption is wrong or someone is really good at getting
> through.
>
> What should be happening here? Thanks, Jim