[31651] in North American Network Operators' Group
Re: QAZ probes from webtv?
daemon@ATHENA.MIT.EDU (Dan Hollis)
Tue Oct 3 22:07:12 2000
Date: Tue, 3 Oct 2000 19:05:25 -0700 (PDT)
From: Dan Hollis <goemon@sasami.anime.net>
To: "'nanog@merit.edu'" <nanog@merit.edu>
Message-ID: <Pine.LNX.4.21.0010031905040.18691-100000@anime.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Errors-To: owner-nanog-outgoing@merit.edu
On Tue, 3 Oct 2000, John Fraizer wrote:
> So, Dan's ACL was trapping any TCP traffic destined to 7597 and not just
> TCP SYN?
Yes, although out of 50 million packets, the webtv servers/clients were
the only ones to *consistently* choose 7597 over the span of several days,
at different times of day and night.
I've got better ACLs now.
-Dan
