Re: Are these port 119 connects abnormal
From: Ken (ng3122_at_ke9nr.#nospam#.net)
Date: 05/26/03
- Previous message: 2Host.com - Robert: "Re: Possible NOT to log IP addresses?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Mon, 26 May 2003 11:44:46 -0700
Hi Harry -
On Mon, 26 May 2003 08:08:24 -0700, Harry Putnam <reader@newsguy.com>
wrote:
>These servers all send tcp connects from 119 to my firewall. I get
>the news alright but some of the connects are dropped by firewall.
>I wondered if there is something abnormal about them:
I suspect that the news servers are sending something after your
reader has ended the connection. Since this is happening with all
three of those servers, the problem is probably a minor bug in your
news reader program. I'm not familiar enough with the NNTP protocol
to know which end is supposed to terminate the connection, but it may
be that the server is supposed to end the connection but the reader
program is ending it instead. If this is the case, then the blocked
packets would probably be the server trying to end the connection.
- Previous message: 2Host.com - Robert: "Re: Possible NOT to log IP addresses?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
