On Tue, Jul 16, 2002 at 03:03:56PM -0700, Paul Bauer wrote: > I have a question though. I am getting the following in a random > timepattern.
This is really a razor-users question, not a SA-talk question, but ... > 07/16-14:46:37.040427 192.168.1.133:2791 -> 194.109.217.74:7 > 07/16-14:46:37.231578 194.109.217.74:7 -> 192.168.1.133:2791 194.109.217.74 is munitions2.xs4all.nl, aka: ubik.cloudmark.com port 7 is echo, probably working as a "ping". > 07/16-14:54:59.575347 192.168.1.133:2800 -> 194.109.217.74:23 > 07/16-14:54:59.765325 194.109.217.74:23 -> 192.168.1.133:2800 I don't know why you're trying to telnet to that host. > 07/16-14:55:04.838479 192.168.1.133:2801 -> 194.109.217.74:25 > 07/16-14:55:05.032389 194.109.217.74:25 -> 192.168.1.133:2801 or send it SMTP. > Is this for vipul and if so > 1. how do I keep the outgoing port stationary for my IDS to stop > mailing me. and 2. what is this doing. If this is off topic and needs > to go elsewhere please let me know. You probably can't keep the port stationary, it's likely choosing any available high-numbered port to go out. I don't know what's doing it off hand. The Razor code (v1 and v2) doesn't seem to do any of this kind of stuff. The only connections I've found so far is the port 2702 stuff which is the expected razor behavior. -- Randomly Generated Tagline: "What do you get the person who has everything? - A calendar... Reminds them when all the bills are due." - Theo ------------------------------------------------------- This sf.net email is sponsored by: Jabber - The world's fastest growing real-time communications platform! Don't just IM. Build it in! http://www.jabber.com/osdn/xim _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
