<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font face="FreeSerif">I'm experimenting with several aspects of my
networking setups, both at home and elsewhere, in particular with
regard to what folks perceive as <a class="moz-txt-link-abbreviated" href="ftp://ftp.xiphos.org">ftp.xiphos.org</a>. </font><font
face="FreeSerif"><font face="FreeSerif">Now and then, </font>I
turn on firewall rejection logging for a few hours or a day, to
see what the next day's reports tell me about attempted attacks
from outside. Imagine my surprise in looking through the system
event log email, and finding:<br>
<br>
</font><font face="FreeSerif"><font face="FreeSerif">1
mail.crosswire.org pinkchip LOGGED 9928/tcp<br>
1 mail.crosswire.org pinkchip LOGGED 12712/tcp<br>
1 mail.crosswire.org pinkchip LOGGED 26315/tcp<br>
1 mail.crosswire.org pinkchip LOGGED 59779/tcp</font><br>
<br>
In logwatch email:<br>
</font><br>
<font face="FreeSerif"><font face="FreeSerif">From 209.250.6.230 - 4
packets to tcp(9928,12712,26315,59779) <br>
</font><br>
For some reason, mail.crosswire.org sent a few utterly random TCP
SYN packets my way around 5am yesterday.<br>
<br>
Feb 17 05:21:07 pinkchip kernel: IN=wlp2s0 OUT=
MAC=40:25:c2:64:77:e0:82:b2:34:47:92:bf:08:00 SRC=209.250.6.230
DST=10.1.10.201 LEN=60 TOS=0x00 PREC=0x20 TTL=57 ID=29712 DF
PROTO=TCP SPT=47138 DPT=9928 WINDOW=14600 RES=0x00 SYN URGP=0 <br>
Feb 17 05:21:07 pinkchip kernel: IN=wlp2s0 OUT=
MAC=40:25:c2:64:77:e0:82:b2:34:47:92:bf:08:00 SRC=209.250.6.230
DST=10.1.10.201 LEN=60 TOS=0x00 PREC=0x20 TTL=57 ID=25996 DF
PROTO=TCP SPT=55280 DPT=59779 WINDOW=14600 RES=0x00 SYN URGP=0 <br>
Feb 17 05:21:08 pinkchip kernel: IN=wlp2s0 OUT=
MAC=40:25:c2:64:77:e0:82:b2:34:47:92:bf:08:00 SRC=209.250.6.230
DST=10.1.10.201 LEN=60 TOS=0x00 PREC=0x20 TTL=57 ID=49165 DF
PROTO=TCP SPT=38550 DPT=12712 WINDOW=14600 RES=0x00 SYN URGP=0 <br>
Feb 17 05:21:08 pinkchip kernel: IN=wlp2s0 OUT=
MAC=40:25:c2:64:77:e0:82:b2:34:47:92:bf:08:00 SRC=209.250.6.230
DST=10.1.10.201 LEN=60 TOS=0x00 PREC=0x20 TTL=57 ID=31602 DF
PROTO=TCP SPT=50726 DPT=26315 WINDOW=14600 RES=0x00 SYN URGP=0 <br>
<br>
The choice of ports is peculiar.<br>
<br>
Do we need to be concerned that mail.crosswire.org has been
compromised? Or am I missing something?<br>
</font>
</body>
</html>