I just installed Firestarter on a 7.04 system at home and have started
to see this problem.

This morning, several "active connections", originating on my home
system and going to weird high-numbered ports on a target system I had
never heard of before, were being reported by Firestarter.  "netstat -a"
didn't show these connections.

Not surprisingly, my first horrified thought was that perhaps a hacker
had broken into my system and installed a rootkit to prevent "netstat"
from revealing his evil deed, but that Firestarter was showing him!

Anyway . . . .  My home system is behind a firewall, and when I scanned
the firewall's logs for the target IP address and port numbers, I found
several INBOUND connections FROM the mysterious host in question, with
the SOURCE ports (on the remote host) being the same weird high-numbered
ports reported by Firestarter, and with the DESTINATION port (on my end)
in each case being 25 (the SMTP port -- my home system functions as a
backup SMTP server).

So, it appears that Firestarter somehow got info about an inbound SMTP
connection, but then recorded it for display as if it were an active
outbound connection.

And as others have reported, these bogus "active connection" entries
will not go away unless I reboot.

Is it possible that this is in fact a networking bug in 7.04, and that
the real culprit is not Firestarter, but some kernel table that
Firestarter is accessing (but which "netstat -a" isn't looking at)?  Or,
perhaps, that Firestarter is looking at the same kernel table that
"netstat" uses, but is misinterpreting something it sees in that table?
That would seem to explain why the bogus "active connection" entries
don't go away when the Firestarter GUI is restarted, but only if the
computer itself is restarted.

-- 
Closed connections shown in "Active connections"
https://bugs.launchpad.net/bugs/112334
You received this bug notification because you are a member of Ubuntu
Bugs, which is the bug contact for Ubuntu.

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to