Re: Connections from 158.152.1.48/158.152.1.53

Article View: demon.ip.support.nt

Article #81

Back to demon.ip.support.nt Previous Next

#81

From: Richard Tibbetts
Date: Wed, 17 Jul 2002 07:47

31 lines
2270 bytes

In message <0vGOdmCAhJN9EAgE@highwayman.com>, Richard Clayton
<richard@highwayman.com> wrote on Tue, 16 Jul 2002 23:03:44 +0100:

> In article <l409jucpmg7vfflb88i9930172dvhaoklg@4ax.com>, Richard
> Tibbetts <richard@primepeace.ltd.uk> writes
> 
> >Should I be worried?  
> 
> yes, your firewall is either useless or you've configured it wrongly

Though the latter is more than possible, the former seems to be the
case this time.  It appears there was a memory leak on the machine,
which had been running for 17 days, and the proxy software/firewall
had run out of memory.

> >My firewall has suddenly started logging *lots*
> >of attempted connections from the Demon DNS servers from port 53,
> >trying to connect to a variety of 4nnn ports.  

Why on port 4nnn??

> I expect it is returning the details of names you have looked up
> 
> >This seems to be a new
> >thing.
> 
> then it will be something you changed recently

-- 
Richard Tibbetts
http://www.primepeace.ltd.uk/

Technical Details

Message-ID: <h08ajus7tpb6fod14njq854i9ojgkfsk5a@4ax.com>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-01!sn-xit-08!supernews.com!pd2nf1so.cg.shawcable.net!residential.shaw.ca!ps01-sjc1!news.webusenet.com!news.tele.dk!small.news.tele.dk!212.74.64.35!colt.net!kibo.news.demon.net!news.demon.co.uk!demon!ppeace.demon.co.uk!not-for-mail

References: <l409jucpmg7vfflb88i9930172dvhaoklg@4ax.com> <0vGOdmCAhJN9EAgE@highwayman.com>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 112d46,c716dabf41f2b438
X-Google-Attributes: gid112d46,public
X-Google-ArrivalTime: 2002-07-17 00:53:00 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-01!sn-xit-08!supernews.com!pd2nf1so.cg.shawcable.net!residential.shaw.ca!ps01-sjc1!news.webusenet.com!news.tele.dk!small.news.tele.dk!212.74.64.35!colt.net!kibo.news.demon.net!news.demon.co.uk!demon!ppeace.demon.co.uk!not-for-mail
From: Richard Tibbetts <richard@primepeace.ltd.uk>
Newsgroups: demon.ip.support.nt
Subject: Re: Connections from 158.152.1.48/158.152.1.53
Date: Wed, 17 Jul 2002 08:47:09 +0100
Organization: primepeace ltd - independent cyborg consultancy
Message-ID: <h08ajus7tpb6fod14njq854i9ojgkfsk5a@4ax.com>
References: <l409jucpmg7vfflb88i9930172dvhaoklg@4ax.com> <0vGOdmCAhJN9EAgE@highwayman.com>
Reply-To: richard@primepeace.ltd.uk
NNTP-Posting-Host: ppeace.demon.co.uk
X-NNTP-Posting-Host: ppeace.demon.co.uk:158.152.75.77
X-Trace: news.demon.co.uk 1026892015 nnrp-01:10418 NO-IDENT ppeace.demon.co.uk:158.152.75.77
X-Complaints-To: abuse@demon.net
X-Newsreader: Forte Agent 1.91/32.564
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Lines: 31

Reply to Parent Message