Article View: comp.sys.mac.apps
Article #12784Re: Activity Monitor: Where's the incoming data going?
From: Jeffrey Goldberg
Date: Mon, 04 Aug 2008 00:14
Date: Mon, 04 Aug 2008 00:14
33 lines
2477 bytes
2477 bytes
In <%golk.104$ZV1.97@trnddc07>, Wes Groleau wrote: > I just ran tcpdump here for approximately a half-hour. > I filtered out anything sourced on our LAN, so it was > only incoming. > > 407 items. > 164 were nntp > 140 were pop3 > 104 were ??? not IP, probably arp, len 52 > (Can't tell because I used awk to only catch size, src/port, dest/port) Looking at my perimeter firewall logs for August 3, I see 699 blocked attempts, mostly to high udp ports often used for IM and chat like things. Note that I don't even bother logging blocks to udp ports 137-143 (netbios, and related Windows vulnerabilities) because my log files were getting to big. On my external facing server, I have 311 failed ssh log in attempts for the same period. These numbers seem a bit low than usual, but within the normal range. Here is another thing you can try. Unplug all of your machines from your router, but leave it connected to the net. Every time you see the light flicker, it means that something is probing you. -j -- Jeffrey Goldberg http://www.goldmark.org/jeff/ I rarely read top-posted, over-quoting or HTML postings. http://improve-usenet.org/
Technical Details
Message-ID:
<alpine.OSX.1.10.0808031905350.36642@hagrid.ewd.goldmark.org>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mailReferences:
<siegman-E4BA74.10091903082008@news.stanford.edu> <jollyroger-9126A2.12143803082008@news.individual.net> <_rydnY1XH8vIYQjVnZ2dnUVZ_u2dnZ2d@comcast.com> <%golk.104$ZV1.97@trnddc07>Show Full Headers
Complete Article Headers
X-Google-Thread: feb82,1bee9a508ee53d74 X-Google-Thread: 1156c9,1bee9a508ee53d74 X-Google-Thread: fa874,1bee9a508ee53d74 X-Google-Attributes: gidfeb82,gid1156c9,gidfa874,domainid0,public,usenet X-Google-Language: ENGLISH,ASCII-7-bit Path: arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: Jeffrey Goldberg <nobody@goldmark.org> Newsgroups: comp.sys.mac.apps,comp.sys.mac.system,ba.internet Subject: Re: Activity Monitor: Where's the incoming data going? Date: Sun, 3 Aug 2008 19:14:57 -0500 Lines: 33 Message-ID: <alpine.OSX.1.10.0808031905350.36642@hagrid.ewd.goldmark.org> References: <siegman-E4BA74.10091903082008@news.stanford.edu> <jollyroger-9126A2.12143803082008@news.individual.net> <_rydnY1XH8vIYQjVnZ2dnUVZ_u2dnZ2d@comcast.com> <%golk.104$ZV1.97@trnddc07> Reply-To: Jeffrey Goldberg <jeffrey+news@goldmark.org> Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Trace: individual.net 2SnW0gGj1l0RQuWxQsOL6Q/wg+7XE815ErbWIfbx+kru2woFTU X-Orig-Path: hagrid.ewd.goldmark.org!jeffrey Cancel-Lock: sha1:vRzIhgXwZ9vW471iYy7Fj+BiTV0= X-X-Sender: jeffrey@hagrid.ewd.goldmark.org In-Reply-To: <%golk.104$ZV1.97@trnddc07> User-Agent: Alpine 1.10 (OSX 962 2008-03-14)