Computer systems blamed for feeble hurricane response?

Tue Sep 13 20:35:47 UTC 2005

On Tue, 13 Sep 2005 15:50:12 EDT, Joseph S D Yao said:

> Oh, and also ... please consider that some firewalls try to discern
> whether the connection on port 25 is from a mail server or from Telnet.

OK, I'll bite.  A long time ago, I saw code that would trap the fact that many
telnet binaries would send option negotiation on ports other than 21.  What
are they keying off now? Since the host in question gave a 'Connection Refused',
it obviously made its decision based on the initial SYN packet.  So what are
they looking at?  TCP options? initial window? other?

16:25:37.240700 IP h80ad2467.async.vt.edu.43404 > listserv.vt.edu.smtp: S 1026334142:1026334142(0) win 5840 <mss 1460,sackOK,timestamp 3672334 0,nop,wscale 2>
16:25:57.420455 IP h80ad2467.async.vt.edu.45093 > listserv.vt.edu.smtp: S 1074086420:1074086420(0) win 5840 <mss 1460,sackOK,timestamp 3677379 0,nop,wscale 2>

One was a telnet connection, one was Sendmail.  Damned if I can tell.. ;)

Of course, a busticated firewall trying to tell the difference *would* explain why
they aren't accepting mail. :)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20050913/7d790518/attachment.sig>