ENOSIG Discussie (threads)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Weird packet

On Wed, Mar 20, 2002 at 10:59:27AM +0100, Joost van Baal wrote:

>> Has anyone any idea why a machine get such a packet?

>> Packet log: input *ACTION* *iface* PROTO=6 *my_machine_ip*:65535 L=756 S=0x00 I=33890 F=0x005D T=51 (#20)

>> whois

> Perhaps the source address is spoofed?

I fail to see what the sender would gain... An RST storm on
Microsoft's web server? Come on...There are much more efficient DOS

> Or it's some Microsoft automatic software update thingie?

Well... might be.... But this is a SYN packet... It seems really
strange to me they would use such a method, where their machine makes
a connection to the client's machine...

> Machine is unreachable now, btw.

You mean by ping? This is "normal", Microsoft's web server haven't
been responding to ping's for years. There is a web server running and
responding on it, though.

I have half a mind to run tcpdump and look at these packets more


[ Date Index] [ Thread Index]