From owner-freebsd-security Wed Jan 9 20:24:33 2002 Delivered-To: freebsd-security@freebsd.org Received: from mirage.nlink.com.br (mirage.nlink.com.br [200.249.195.3]) by hub.freebsd.org (Postfix) with SMTP id 3C18F37B41A for ; Wed, 9 Jan 2002 20:24:30 -0800 (PST) Received: (qmail 31297 invoked by uid 501); 7 Jan 2002 16:36:11 -0000 Received: from localhost (sendmail-bs@127.0.0.1) by localhost with SMTP; 7 Jan 2002 16:36:11 -0000 Date: Mon, 7 Jan 2002 14:36:11 -0200 (BRST) From: Paulo Fragoso To: Subject: LAST_ACK traffic? Message-ID: <20020107141924.C55391-100000@mirage.nlink.com.br> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Hi, In our network there are some workstation under a firewall, today we ware looking our internal traffic, there was one workstation sending packets to one webserver at 200kbps: roto Recv-Q Send-Q Local Address Foreign Address (state) tcp4 0 0 our.work.station.1412 200.226.137.10.80 LAST_ACK The user that workstation was using Opera 6.0 for linux (on FreeBSD 4.4-RELEASE). The strange traffic had started after the he closed the opera. Are there any secure problem with this? Why our workstation was send packets of LAST_ACK whithout any processes bound at 1412 (checked with lsof)? Many Thanks, Paulo Fragoso. -- __O _-\<,_ Why drive when you can bike? (_)/ (_) To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message