Port scans shown as balloon tip despite blocking in AuthHost

[Novgorod]

Hi,

Since UVNC got the function to show failed connection attempts (e.g. port scans) as a balloon tip, it's popping up from time to time and can get quite annoying if it happens a lot. I know it's possible to turn it off completely, but on the other hand it's interesting to see who's trying to hack me .. However, sometimes a single IP is doing connection attempts over and over again, which makes "annoying" win over "interesting". I tried therefore to block a particular IP completely using AuthHost in the ini file, but the balloon tips still appear with that IP address:


Did I do anything wrong or is this by design? I assumed that blocking through AuthHost will immediately drop any connection and not mention it as a failed connection attempt...

[Rudi De Vos]

Took some time to debug

The connection break because it's not a rfb message ( like some port scanner) , no rfb -> disconnect
Only if message is rfb we check the auth list, in that case we send a message to the viewer telling he is refused before breaking the connection.

The ballon tip popup was not intended for this, but some site effect. No option exist to disable it.

[Novgorod]

Thanks for looking into it. Would it make sense to "fix" this in a future version, since the balloon popup is not intended to show connections without rfb messages (as you said), such as port scans? I think many people get these "false alerts" now, since port scans are so prevalent on the internet...

[Rudi De Vos]

The alert was actual added for the outgoing connection. ( server connect to viewer)
In case the viewer is offline we only get the initial rfb exhange fail and that's the p)opup you see.

The method should differentiate between in/outgoing and skip for in.

[Novgorod]

The method should differentiate between in/outgoing and skip for in.

This sounds perfect! Looking forward to the next release ...