[31647] in North American Network Operators' Group
Re: QAZ probes from webtv?
daemon@ATHENA.MIT.EDU (Sami Juvonen)
Tue Oct 3 18:00:00 2000
Message-ID: <37C3476607141849A65191FB44C1D5731138FF@svc-msg-03.northamerica.corp.microsoft.com>
From: Sami Juvonen <samij@corp.webtv.net>
To: "'nanog@merit.edu'" <nanog@merit.edu>
Date: Tue, 3 Oct 2000 14:57:52 -0700
Errors-To: owner-nanog-outgoing@merit.edu
Dan Hollis <goemon@sasami.anime.net> wrote on Sun, 1 Oct 2000 20:08:03 -0700
(PDT):
> Anyone else seeing webtv probing your customers for QAZ?
> The following webtv hosts seem to be probing our dialup customers port
> tcp/7597:
WebTV Networks is not probing for QAZ.
After reviewing the log files Dan Hollis provided, it appears that
these packets are normal TCP communication between a WebTV terminal
and the WebTV service. The client terminal initiates a connection,
picking a random source port. The service is trying to establish a
connection with the client using that port. This behavior is not
limited to WebTV. It appears that the packet from the service was
caught in Dan's perimeter router ACL.
Please do not hesitate to contact us if you have any concerns about
WebTV and security or network interoperability issues. Please see
http://www.webtv.net/contact/contact.html for contact information.
Thank you,
Sami Juvonen, Systems Engineer,
WebTV Networks, Operations Engineering
