Excessive sessions warning

Adam · Jan 12, 2008, 15:08:20

I've been getting the following error with my 2700HGV:

"Error: The following devices on your network are using a large number of internet sessions."

It stops all web browsing and redirects to that page, though it allows other traffic to continue. I'm assuming it is caused by my use of BitTorrent and have set it to not be displayed again. It suggests that it may be caused by a "blaster" like virus, though I believe the computer it was blocking is clean.

I'm just wondering if anyone else has has this error and if it is indeed torrents causing it.

Rik · Jan 12, 2008, 15:13:30

I don't use torrents, sorry.

psp83 · Jan 12, 2008, 15:45:15

Yes i've had it aswell... General browsing caused mine.

Go to home/tech

click on advanced settings under firewall

untick this box:-

Attack Detection
Excessive Session Detection

Ted · Jan 12, 2008, 15:46:48

Hi Adam
You can disable Excessive Session Detection in the Firewall advanced settings, or is that what you already did?

Ted · Jan 12, 2008, 15:48:12

Snap!!

Adam · Jan 12, 2008, 15:51:50

Quote from: xild on Jan 12, 2008, 15:46:48
Hi Adam
You can disable Excessive Session Detection in the Firewall advanced settings, or is that what you already did?

I simply ticked the box which said 'Select this box to not show filter warnings in the future', is it better to completely disable it?

Update: It seems to have disabled 'Excessive Session Detection' itself, presumably by my ticking of the box.

kinmel · Jan 12, 2008, 15:53:45

I have had it a couple of times whilst "Stumbling" very quickly through some boring pages.

If you select "not to be displayed again", it clears the tickbox Attack Detection -Excessive Session Detection on the Firewall – Advanced Settings page

Ted · Jan 12, 2008, 16:02:41

Quote from: kinmel on Jan 12, 2008, 15:53:45
I have had it a couple of times whilst "Stumbling" very quickly through some boring pages.

If you select "not to be displayed again", it clears the tickbox Attack Detection -Excessive Session Detection on the Firewall – Advanced Settings page

just tried to replicate that, did about 12 sites very quickly, showed no problem!
Don't do torrents, so can't try that.

psp83 · Jan 12, 2008, 16:09:47

Mine did it when i was viewing a friends gallery.. Had loads of holiday images on it.

Ted · Jan 12, 2008, 16:13:31

This is what it says in the 2wire PDF manual

"Attack Description and Action Taken
Excessive Session Detection When enabled, the firewall will detect applications on the
local network that are creating excessive sessions out to
the Internet. This activity is likely due to a virus or "worm"
infected computer (for example, Blaster Worm). When the
event is detected, the gateway displays a HURL warning
page."

I'd say it was the torrent to blame.

psp83 · Jan 12, 2008, 16:19:19

I dont download torrent

Atleast theres an option to turn this off thou

it would be annoying if there wasn't

Montala · Jul 13, 2008, 17:28:32

Hi,

I realise that this is quite an old topic, but as I received exactly the same message this morning, I thought that this would be the best place to mention it.

... and before anyone asks, I have never been near any Torrent sites; in fact I was browsing on Amazon.co.uk the first time it happened.

Even a cold reboot didn't really seem to solve the problem, but a quick 'Google' bought me to this thread.

I am just about to untick the appropriate box on the Firewall Settings page, and will then have to wait and see if it occurs again.

I did wonder whether it could be down to BT doing a bit of Sunday morning server maintenance though!

Rik · Jul 13, 2008, 17:29:44

It shouldn't be, but with BT anything is possible.

Have you run a malware scan?

Ann · Jul 13, 2008, 17:56:32

I've not had it myself (yet) but I'd be a bit wary of simply turning it off if it's supposed to be warning you about something. I'd want to know why it was reporting it first.

Sebby · Jul 13, 2008, 18:45:22

It could suggest some kind of malware, and in fact that's the 2700's reason for warning you. If you don't run any P2P (not just BitTorrent) then I would suggest you do an antivirus and malware scan (I like SUPERAntiSpyware). If nothing is found, you can switch this warning off.

Ann · Jul 13, 2008, 20:48:03

And just hope you don't get caught by malware or whatever in the future 'cos you won't get any warning...

Sebby · Jul 13, 2008, 22:17:23

It's a good point, but what is one supposed to do if the message won't go away and you've checked for malware?

Rik · Jul 14, 2008, 09:04:31

Buy a Netgear?

somanyholes · Jul 14, 2008, 09:22:36

I'm not familiear with the device but does anyone here know if you can show the current connections on the device? I would of thought this would help.

If not do you have a software firewall on the machine/machines on your lan, these may show your current connections

If not pull up a command prompt and type (on all machines on lan)

netstat -b

this will show you what applications are doing what and should help. The more connections that you see the more likely it is that the application will be causing the issue.

Rik · Jul 14, 2008, 09:25:03

Not afaik, So. You can see what machines are connected, but it doesn't seem to go any 'lower' than that.

Montala · Jul 14, 2008, 09:27:06

Quote from: Rik on Jul 14, 2008, 09:04:31
Buy a Netgear?

Do you mind... I have just replaced a Netgear DG834PN with my shiny new 2Wire 2700HGV!!

Rik · Jul 14, 2008, 09:28:40

It doesn't have this problem, though...

Montala · Jul 14, 2008, 09:30:19

Quote from: somanyholes on Jul 14, 2008, 09:22:36
If not pull up a command prompt and type (on all machines on lan)

netstat -b

Just tried that, only to be told "The requested operation requires elevation"... so that's put me in my place!

Rik · Jul 14, 2008, 09:33:16

Vista? If so, you may need to right-click and run as admin (I think...).

somanyholes · Jul 14, 2008, 09:34:13

sounds like your on vista, you will need to run the command prompt as administrator.

kinmel · Jul 14, 2008, 10:31:14

The only times we have seen this warning is when we are opening lots of new pages in very quick succession at stumbleupon and photo sites.

So we leave the detection turned on and on the rare occasion the warning appears we assess the threat, so far it has always been when expected

Gary · Jul 14, 2008, 10:36:14

Quote from: Montala on Jul 14, 2008, 09:27:06
Do you mind... I have just replaced a Netgear DG834PN with my shiny new 2Wire 2700HGV!!

The PN had a bunch more though Rik

I still like my DG834G v4

Montala · Jul 14, 2008, 13:17:24

Thanks for all the comments and advice everyone!

Just to update you with my current position etc.

1) I have carried out a full virus/malware scan... nothing found!

2) Yes, I am running Windows Vista, and as I only have the one user (Administrator) account, I assumed that I was always running as one! Anyway, I right clicked, ran as Administrator, entered netstat -b which then advised me that the only Active Connections (other than my PC itself) were "AppleMobileDeviceService" and "iTunesHelper" both of which I can probably disable anyway.

3) Something which may have no bearing on the problem at all, but which I thought worth mentioning anyway... my computer is left 'switched on' every day from about 8am to 11pm but at night I have been in the habit of turning everything (including my 2Wire hub) off at the 'mains'. When I turned it on the last couple of mornings, I haven't waited for the two green lights to show before turning on my PC etc. But now I do!

4) In view of earlier comments, I have now re-ticked the 'Excessive Sessions Detection' box, and will see if any more warning do in fact appear.

Sorry for the long post, but I thought I might as well say it all at once, while I was inside, as I have just being out trying to mow the lawns... but it started raining!

Rik · Jul 14, 2008, 15:07:50

So thee rain was your fault, eh.

Simon · Jul 14, 2008, 17:51:10

Quote from: Rik on Jul 14, 2008, 15:07:50
So thee rain was your fault, eh.

Was it of biblical proportions?

Rik · Jul 14, 2008, 18:06:18

Montala · Jul 14, 2008, 22:22:31

Quote from: Simon on Jul 14, 2008, 17:51:10
Was it of biblical proportions?

Nah... just a bit of drizzle really, but enough to be unpleasant!

Fortunately it was dry again after lunch, so I was able to finish the job... and put a few new plants in as well!