Green listen port can be a false indication

[gasman]

This relates to a change made to bitcomet some time ago.

The problem was that users were reporting a blocked listen port indication yet were still achieving remote connections.

If I remember correctly, Bitcomet code was adjusted such that once a remote connection was established the green light would be turned on.

My problem was this. upon starting bitcomet I would have a blocked port indication and only local connections. Then, after a random time interval (could be a few seconds or several hours) the green light would turn on but I was still seeing poor speeds and very few remote connections.

Investigation proved this to be my firewall (Mcafee in my case) simply proved by complete removal of Mcafee, just turning the firewall off was not effective.

I then contacted Mcafee support whom I found to be excellent via online chat but it took them over 2 hours (many reinstalls reboots etc) but eventually they came up trumps and all is 100%

It seems that Mcafee was blocking the majority of inbound connections but the "odd" one would get through thus triggering the green light.

In light of this it is my opinion that the code change to bitcomet such that the green light comes on once a single remote connection is established was a bad idea. It could well be giving you a false report as in my case.

I would welcome your opinions on this

[The UnUsual Suspect]

I can see how this could give you a false sense of security if you have a defective firewall, but I don't think there is any solution bitcomet could implement to assure you receive all your incoming connections. Historically BitComet has used an Active test where it pings it's own remote server then waits for an incoming remote connection to confirm the port is working. This is usually a conclusive test but we began getting an overwhelming number of users that didn't show a green light and had remote peers. In most cases this was due to improper use of IP filter programs like peerblock or protowall which if you prevent bitcomet from contacting the server, it cannot test the port, so a second passive test was coded that is secondary to the first and will show a green light when remote peers appear. This second test is how much of the competition tests, but it requires the presence of remote peers before the test can be complete. The initial bitcomet Active test is faster and usually more accurate, but we feel adding the second passive test was necessary to prevent panic from users who unknowingly have disabled much of bitcomets more advanced features.

There were also some cases where users had attached uPnP devices that were slow to respond and would initially test as blocked but when retested would show green because of a delay in port mapping.

I'm also troubled by your report on McAfee. I used to use their products but they continued to force "improvements" on me that made it more and more difficult to use and less reliable, and ultimately I had to get rid of their products because they used far more resources than necessary. I understand you seem very pleased with their tech support, but if understand you correct there were two problems, the first being that it didn't open the port when it should have, and the second which I gathered by reading "between the lines" is that even when blocked, some of the connections got through. This makes me wonder how many bad connections "slip through"their firewall. I think if I was going to continue to use their products I'd do some extreme testing on it to make sure it doesn't fail when you need it most. The first question that comes to mind is does this product continue to block if the process becomes unresponsive? or does it act like guards that have fallen asleep at their post.

I used to use a product called Sygate, it was extremely lean and never failed to respond. Many thought it was annoying because by default it blocked 100% of all connections, but after you've trained it what to allow it was perhaps the best firewall ever made, however it was soon purchased by the competition who didn't like a superior product that was free.

My concern is if a firewall is bundled with an app that is so bloated it becomes unresponsive, is the firewall still working. I can't really speak to any McAfee products of the last couple years since I haven't used them, but you may want to look into this further. I was also troubled with McAfee's support always defaulting to redownload and reinstalling anytime there was a problem. They even had me download in safe-mode many years ago after several downloads/installs with repeat issues. It's pretty simple to confirm a download is intact and they wasted several hours with repeat re-installs before finally escalating the issue. In my experience their first level of support only know how to do one thing, the redownload and re-install, but hopefully they have improved over the years and having run this support forum for 10 years I can certainly understand that it's not an easy job and why they'd want to rule out install problems before giving a case serious attention.

ps. please keep us updated on your thoughts about the current mcafee products, I'm not likely to use them myself, but I'm sure many of our users will and it's nice to get some feedback from members.

[gasman]

Hi TUUS,

I agree with everything you say, I too wondered about "the one that slipped through" and if that was an indication of a security flaw. however the proof is in the pudding and I have not had a problem with my system for over a year now with BC working perfectly.

Re Mcafee, yes my problem had to be escalated to tier2 as they call it but once there all went smoothly and efficiently. they really do have excellent customer support. My early days with Mcafee were problematic, it was very resource hungry and slow but that has improved over the years. Despite saying all that I find them now to have become too expensive and considering a change, am just wary of what problems I might encounter. doing my research now but any suggestions would be welcome

[The UnUsual Suspect]

I think the only way to tell if the firewall is doing it's job would be using a service designed to attack the firewall and do this at a time when you have your system overtaxed to the point that it's on the verge of becoming unresponsive. The key to look for is does the firewall stop all connections when it's not responding, or does it let them all through?

I use kaspersky on this laptop and I get a free key each year so I do most of my testing on this. My office computer isn't exposed to as much so I use the free microsoft apps. I'm also behind a router so that gives me another level of protection, no inbound connections will get past my router unless they know the LAN and the computers on it, but in that case the software firewall does it's job. I use windows firewall on the office computer. If you're looking for a better free firewall you might try outpost personal firewall. I've heard a lot of good reports about it. Also there are online scanners that use all the popular anti virus scanners to test anything you suspect to be a threat.

[gasman]

After looking into various reviews on firewalls, antivirus and suites it seems that Mcafee comes way down the list, so perhaps my confidence in it is misplaced. However just as with Bitcomet, there is always a learning curve (I remember all to well my early frustrations with BC) and perhaps some of these reviews have yet to take that curve.

Comodo seems to be the one getting all the stars at the moment and it is a little cheaper than Mcafee, but I have to ask myself, do I really want to get rid of a system that is working for me in exchange for a few less dollars and a totally new learning curve? :unsure: