Re: [OT] Windows applications generating ISA-KMP packets?

From: Peter Pentchev (roam@ringlet.net)
Date: 11/20/02


Date: Wed, 20 Nov 2002 18:38:32 +0200
From: Peter Pentchev <roam@ringlet.net>
To: freebsd-security@FreeBSD.org


On Wed, Nov 20, 2002 at 04:39:43PM +0200, Peter Pentchev wrote:
> Hi,
>
> Apologies for the somewhat off-topic post; I am also sending this to a
> couple of other security-related lists, where it will be more relevant,
> but any replies would be welcome..
>
> Today, a company I do some work for received an e-mail inquiry
> regarding strange packets sent to an address unknown to us. The packets
> in question were UDP packets with 500 as both source and destination
> port.

Thanks to everyone who replied; this seems to be the result of a Win2K
group policy setting concerning IPsec, and hopefully the stray ISA-KMP
packets will not be sent any longer.

G'luck,
Peter

-- 
Peter Pentchev	roam@ringlet.net	roam@FreeBSD.org
PGP key:	http://people.FreeBSD.org/~roam/roam.key.asc
Key fingerprint	FDBA FD79 C26F 3C51 C95E  DF9E ED18 B68D 1619 4553
I am the meaning of this sentence.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message




Relevant Pages

  • [SOLVED] Re: UDP multicast packets not seen on listening interface in BETA5
    ... I'm sorry for so many replies to my own thread here, ... I was not properly joining the ... Where 192.168.1.1 is one of the aliased IPs on fxp0, ... ok with nat'ing the packets for now to make it work. ...
    (freebsd-current)
  • Re: ping claims lost packets
    ... > row results in lost packets from ping's point of view, ... > kernel is getting the echo replies back. ... > and stopping and restarting ping, often results in the stated behavior. ...
    (Debian-User)
  • Re: Network Monitor
    ... Got me - and in any case this utility only captures packets, ... need a Server copy of Windows to load and analyze the packets captured. ... >> * PLEASE post all messages and replies in the newsgroups ...
    (microsoft.public.windowsxp.network_web)
  • Re: interesting traffic
    ... | packets in those ranges as being replies to something your systems sent ... On my home firewall, ... | UDP to those ports for several years now. ... | as they can't be valid replies to anything we've sent out. ...
    (alt.computer.security)
  • [OT] Windows applications generating ISA-KMP packets?
    ... but any replies would be welcome.. ... regarding strange packets sent to an address unknown to us. ... Is anybody aware of any reason for a Windows workstation (those are all ...
    (FreeBSD-Security)