Article View: demon.ip.support.nt
Article #82Re: Connections from 158.152.1.48/158.152.1.53
From: Richard Clayton
Date: Wed, 17 Jul 2002 09:15
Date: Wed, 17 Jul 2002 09:15
25 lines
2263 bytes
2263 bytes
In article <h08ajus7tpb6fod14njq854i9ojgkfsk5a@4ax.com>, Richard Tibbetts <richard@primepeace.ltd.uk> writes >> >My firewall has suddenly started logging *lots* >> >of attempted connections from the Demon DNS servers from port 53, >> >trying to connect to a variety of 4nnn ports. > >Why on port 4nnn?? Some port number or other has to be used at your end, and to allow multiple conversations to occur at once a "random" port number will be used (clearly on this occasion selected from 4xxx values) The firewall was not recording the outgoing packet (apparently because of the memory leak), so the returning packet came as a surprise - so it objected to it. BTW I doubt it was "trying to connect" since these would have been UDP packets with nary a TCP SYN in sight. -- richard Richard Clayton They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety. Benjamin Franklin
Technical Details
Message-ID:
<YnMF$ILpWTN9EAl6@highwayman.com>Path:
arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-01!sn-xit-08!supernews.com!feed.textport.net!news-out.nuthinbutnews.com!propagator-sterling!news-in.nuthinbutnews.com!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!newsfeed.icl.net!newsfeed.fjserv.net!kibo.news.demon.net!news.demon.co.uk!demon!gti.noc.demon.net!highwayman.com!richardReferences:
<l409jucpmg7vfflb88i9930172dvhaoklg@4ax.com> <0vGOdmCAhJN9EAgE@highwayman.com> <h08ajus7tpb6fod14njq854i9ojgkfsk5a@4ax.com>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 112d46,c716dabf41f2b438 X-Google-Attributes: gid112d46,public X-Google-ArrivalTime: 2002-07-17 03:06:06 PST Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-01!sn-xit-08!supernews.com!feed.textport.net!news-out.nuthinbutnews.com!propagator-sterling!news-in.nuthinbutnews.com!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!newsfeed.icl.net!newsfeed.fjserv.net!kibo.news.demon.net!news.demon.co.uk!demon!gti.noc.demon.net!highwayman.com!richard From: Richard Clayton <richard@highwayman.com> Newsgroups: demon.ip.support.nt Subject: Re: Connections from 158.152.1.48/158.152.1.53 Date: Wed, 17 Jul 2002 10:15:21 +0100 Organization: Highwayman Associates Ltd Message-ID: <YnMF$ILpWTN9EAl6@highwayman.com> References: <l409jucpmg7vfflb88i9930172dvhaoklg@4ax.com> <0vGOdmCAhJN9EAgE@highwayman.com> <h08ajus7tpb6fod14njq854i9ojgkfsk5a@4ax.com> NNTP-Posting-Host: gti.noc.demon.net X-NNTP-Posting-Host: gti.noc.demon.net:195.11.55.101 X-Trace: news.demon.co.uk 1026900005 nnrp-08:1648 NO-IDENT gti.noc.demon.net:195.11.55.101 X-Complaints-To: abuse@demon.net MIME-Version: 1.0 X-Newsreader: Turnpike Integrated Version 5.01 M <7fPN0OjtGdv6AX1irDkRphaT6+> Lines: 25