🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: demon.security
Article #119

Re: Demon SMTP probes

#119
From: Alan Ford
Date: Sat, 01 Apr 2000 00:00
30 lines
2197 bytes
On Sat, 1 Apr 2000 18:14:24 +0100, Mark Hughes <mark@compware.co.uk> wrote:
>I've recently installed a nifty personal firewall and it is showing me
>that demon is looking for a service on port 25 (SMTP). Two machines
>probe my machine periodically while I am dialed in, and curiously they
>probe from apparently random source ports. See below for some sample
>probes....
[snip punting]
>I don't wish demon to probe my machine for TCP/IP services.

Tough, they can do if they want to (although they have never done so,
to the best of my knowledge, they just reserve the right to).

>Can someone explain why demon appears to be probing my machine when I
>dial in?

You are collecting mail using POP3, I presume. Demon's other method of
mail delivery is SMTP, the original method, where their machines connect
to yours every ten minutes and give you the mail that is waiting for you.

>Is it part of the service agreement that they are able to do this?

Yes, both delivering mail and probing you.

But to disable SMTP delivery, see https://www.password.uk.demon.net/

-- 
     Alan Ford * alan@whirlnet.co.uk * http://www.whirlnet.co.uk/
   PGP Key: 0x8F807D7D - email pgp@whirlnet.co.uk or see keyservers
    Demon Newsgroups Info + FAQs: http://www.whirlnet.co.uk/demon/
!! YOUR PRIVACY IS AT RISK. TELL YOUR MP *NOW*! http://www.stand.org.uk/ !!
Technical Details
Message-ID: <slrn8ecp8k.8gc.alan@whirlnet.demon.co.uk>
Path: arc1-ca.pugleaf.net!unknown!not-for-mail
References: <954609562.14748.0.nnrp-13.9e98ed62@news.demon.co.uk>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 1065b6,fefb3eeb89e1f549
X-Google-Attributes: gid1065b6,public
From: alan@whirlnet.co.uk (Alan Ford)
Subject: Re: Demon SMTP probes
Date: 2000/04/01
Message-ID: <slrn8ecp8k.8gc.alan@whirlnet.demon.co.uk>
X-Deja-AN: 605407574
X-PGP-Fingerprint: BF C2 33 FE 23 38 36 DE  85 7F DA 52 6D 55 0D 67
X-NNTP-Posting-Host: whirlnet.demon.co.uk:158.152.197.29
X-PGP-Keyfile: http://www.whirlnet.demon.co.uk/alan-pgp-key.txt
References: <954609562.14748.0.nnrp-13.9e98ed62@news.demon.co.uk>
X-Complaints-To: abuse@demon.net
X-More-Info: finger:alan@whirlnet.demon.co.uk
X-Trace: news.demon.co.uk 954625023 nnrp-01:2992 NO-IDENT whirlnet.demon.co.uk:158.152.197.29
User-Agent: slrn/0.9.6.2 (Linux)
Newsgroups: demon.security
X-HTCPCP-Error: 418 I'm a teapot