--------------
razor-agents use TCP port 7 (TCP echo) to determine what servers are
closest to it.
cheers,
vipul.
----------------
Razor2 also generates outbound TCP traffic to port 2703 on the razor servers. Razor 1 uses 2702 if I recall correctly.
At 02:06 PM 10/21/2002 -0400, [EMAIL PROTECTED] wrote:
I am getting hits on my firewall showing outbound packets with destination port 7. Is it possible that Razor is doing this? If so, is it at all documented just what ports are required to be left open in order to successfully run SA/Razor?Here are (some of) my hits: Oct 20 18:53:25 saturn kernel: DROP:IN= OUT=eth0 SRC=209.6.241.147 DST=216.52.13.94 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=17664 DF PROTO=TCP SPT=43929 DPT=7 WINDOW=5840 RES=0x00 SYN URGP=0 Oct 20 18:53:28 saturn kernel: DROP:IN= OUT=eth0 SRC=209.6.241.147 DST=216.52.13.94 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=17664 DF PROTO=TCP SPT=43929 DPT=7 WINDOW=5840 RES=0x00 SYN URGP=0 Oct 20 18:53:29 saturn kernel: DROP:IN= OUT=eth0 SRC=209.6.241.147 DST=209.204.62.150 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=17664 DF PROTO=TCP SPT=43930 DPT=7 WINDOW=5840 RES=0x00 SYN URGP=0 Oct 20 18:53:32 saturn kernel: DROP:IN= OUT=eth0 SRC=209.6.241.147 DST=209.204.62.150 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=17664 DF PROTO=TCP SPT=43930 DPT=7 WINDOW=5840 RES=0x00 SYN URGP=0 Oct 20 18:53:33 saturn kernel: DROP:IN= OUT=eth0 SRC=209.6.241.147 DST=216.52.13.91 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=17664 DF PROTO=TCP SPT=43931 DPT=7 WINDOW=5840 RES=0x00 SYN URGP=0 Oct 20 18:53:36 saturn kernel: DROP:IN= OUT=eth0 SRC=209.6.241.147 DST=216.52.13.91 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=17664 DF PROTO=TCP SPT=43931 DPT=7 WINDOW=5840 RES=0x00 SYN URGP=0 Thanks guys. -- -Time flies like the wind. Fruit flies like a banana. Stranger things have - -happened but none stranger than this. Does your driver's license say Organ -Donor?Black holes are where God divided by zero. Listen to me! We are all- -individuals! What if this weren't a hypothetical question? [EMAIL PROTECTED] ------------------------------------------------------- This sf.net emial is sponsored by: Influence the future of Java(TM) technology. Join the Java Community Process(SM) (JCP(SM)) program now. http://ad.doubleclick.net/clk;4699841;7576298;k? http://www.sun.com/javavote _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
-------------------------------------------------------
This sf.net emial is sponsored by: Influence the future of Java(TM) technology. Join the Java Community Process(SM) (JCP(SM)) program now. http://ad.doubleclick.net/clk;4699841;7576298;k?http://www.sun.com/javavote
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
