Re: TCP Connection - Established

From: Steven L Umbach (sumbach_at_nospam-ameritech.net)
Date: 01/31/04 

Date: Sat, 31 Jan 2004 16:56:28 GMT

Hi John.

Excellent and thanks for posting back. Now you know how to track these
issues down. Sygate has a lot of neat features, especially with it's logging
cpability. Glad to help. --- Steve

"John" <john@somewhere.com> wrote in message
news:MPG.1a858b8964a6ce14989684@news.telusplanet.net...
> In article <c7ESb.147041$5V2.785271@attbi_s53>, n9rou@n0spam-comcast.net
> says...
> > Port 1525 tcp is shown as used by Oracle applications in some port
charts.
> > Downloading and using TCPView from SysInternals will help by mapping
ports to
> The mystery is solved. I used Internet explorer to try to connect to
> 207.33.111.82. That failed, but it triggered a popup from my firewall
> advising that this address was trying to make contact with ntoskrnl on
> my machine, and did I want to allow the connection.
>
> Since the mystery connection had *never* left any tracks in my firewall
> log (which would allow me to back trace it) I said "yes" to the firewall
> in order to leave a backtraceable track in the firewall traffic log.
>
> No need to backtrace - the address shows in the traffic log as
> "ssupdates.sygate.com". The connection is used to determine if my
> firewall is up to date, version and patch wise. The firewall doesn't
> report the connection to reduce the "noise factor" I guess.
>
> I'm happy again. Thanks again for your help on the issue, and a general
> thank you for your input to this board.
>
> John.

Relevant Pages

  • Am I being hacked?
    ... I'm running the Sygate Personal Firewall Pro on a Win XP Pro machine. ... The Traffic Log shows that I have received a TCP packet on port 1103 from an ... Is this incoming TCP packet waking up a hidden Trojan? ...
    (comp.security.firewalls)
  • Re: Am I attacked ?
    ... my traffic log indicated about 250 incoming connections ... > amateur when it comes to computers (and a real newbie when it comes to ... We need firewall logs in order to tell whether it was an attack or not. ...
    (comp.security.firewalls)
  • Re: 2 records found for the same IP address on www.ripe.net
    ... I found in the traffic log of my firewall that ... there are any local routers that support multicast by sending a query to ...
    (comp.security.firewalls)
  • Re: 2 records found for the same IP address on www.ripe.net
    ... I found in the traffic log of my firewall that ... 2.0.0.224.in-addr.arpa domain name pointer ALL-ROUTERS.MCAST.NET. ... are limited to the local network and not routed at all. ...
    (comp.security.firewalls)