Re: Demon SMTP probes

Article View: demon.security

Article #121

#121

From: Jim Crowther
Date: Sun, 02 Apr 2000 00:00

25 lines
1746 bytes

In article <954609562.14748.0.nnrp-13.9e98ed62@news.demon.co.uk>, Mark
Hughes <mark@compware.co.uk> writes
>I've recently installed a nifty personal firewall and it is showing me
>that demon is looking for a service on port 25 (SMTP). Two machines
>probe my machine periodically while I am dialed in, and curiously they
>probe from apparently random source ports. See below for some sample
>probes....
>
>194.217.242.6 (punt-21 mail.demon.net) port 59652 to port 25
>194.217.242.34 (punt-11 mail.demon.net) port 44003 to port 25
[]

I also mainly use POP3, but wish to retain the ability for SMTP delivery
whenever necessary.  Rather than go to the password page to disable SMTP
at Demon's end, I allow the IP range 
194.217.242.0 to 
194.217.242.255
access through my firewall (ZoneAlarm).  The packets are then sent to
the bit-bucket by my news client in the usual way. 
 
-- 
Jim Crowther
Mailto:jim@crowfam.demon.co.uk
Public PGP keys at ldap://certserver.pgp.com (and others)
Key ID 0xE0BCE5F1 (DH/DSS 2048/1024), 0x8A673777 (RSA 1024)

Technical Details

Message-ID: <+TGU13Axv254EwWb@crowfam.demon.co.uk>

Path: arc1-ca.pugleaf.net!unknown!not-for-mail

References: <954609562.14748.0.nnrp-13.9e98ed62@news.demon.co.uk>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 1065b6,fefb3eeb89e1f549
X-Google-Attributes: gid1065b6,public
From: Jim Crowther <replies@crowfam.demon.co.uk>
Subject: Re: Demon SMTP probes
Date: 2000/04/02
Message-ID: <+TGU13Axv254EwWb@crowfam.demon.co.uk>
X-Deja-AN: 605677307
X-NNTP-Posting-Host: crowfam.demon.co.uk:194.222.124.187
References: <954609562.14748.0.nnrp-13.9e98ed62@news.demon.co.uk>
X-Complaints-To: abuse@demon.net
X-Trace: news.demon.co.uk 954691856 nnrp-09:26469 NO-IDENT crowfam.demon.co.uk:194.222.124.187
Organization: none whatsoever
MIME-Version: 1.0
Reply-To: Jim Crowther <jim@crowfam.demon.co.uk>
Newsgroups: demon.security

Reply to Parent Message