Re: weird scans from port 80

From: Tim Haynes (usenet@stirfried.vegetable.org.uk)
Date: 01/20/03 

From: Tim Haynes <usenet@stirfried.vegetable.org.uk>
Date: Mon, 20 Jan 2003 16:52:05 +0000

Silviu Minut <silviu@orion.attbi.com> writes:

> On Mon, 20 Jan 2003 08:33:06 -0500, Bill K. wrote:
>
>> In article <3E2ACF08.D4978104@daimi.au.dk>, "Kasper Dupont"
>> <kasperd@daimi.au.dk> wrote:
>>
>>> From RFC 793 page 36:
>>>
>>> As a general rule, reset (RST) must be sent whenever a segment
>>> arrives which apparently is not intended for the current connection.
>>
>> The next sentence reads: "A reset must not be sent if it is not clear
>> that this is the case."
>>
>> Why did you snip it?
>>
>> Sorry for butting in.
>
> This is really funny, it made my day. This deems this discussion useless,
> doesn't it?

Yup, it does, totally.

I'm sure it could've been fun any other day in a more general context
whilst wearing one's reading glasses, but right now we've still got logs to
be oogling.

> Except for the articles addressing directly my unusual logs.

And those were mostly FIN/ACKs, which *is* the sort of thing that conntrack
drops after a shorter while than some connections take. Of the things you
posted, I'd've said the RST+ACK was more interesting.

~Tim 

-- 
  16:50:21  up 32 days,  1:38,  7 users,  load average: 0.04, 0.04, 0.02
piglet@stirfried.vegetable.org.uk |Roobarb and Custard let fly
http://piglet.is.dreaming.org     |with their secret weapon.

Relevant Pages

  • Re: What is the largest acceptable download time?
    ... My general rule of thumb is that the page should load at 30 seconds ... MAXIMUM on a 28.8 connection. ... breaking it up into smaller pages, or reducing the number or size of ...
    (microsoft.public.frontpage.client)
  • Re: hooky 1.0.0 Released
    ... Luis Lavena wrote: ... Maybe is your connection, ... As a general rule: if you think GitHub or Kernel.Org (or, say, Google ...
    (comp.lang.ruby)
  • RE: Firewall Logging question?
    ... programmatic connections like between a web server and a SQL server. ... troubleshoot or validate a connection or a rule. ... the general rule is to log a connection if the entry will add ... Subject: Firewall Logging question? ...
    (Security-Basics)
  • ActiveSync Fails with Norton A/V 2005
    ... I sync my samsung i700 over a pptp vpn connection (thru ... When I enanble the "Internet Worm Protection" feature, ... including creating a "general Rule" to ...
    (microsoft.public.pocketpc.activesync)