cancel
Showing results for 
Search instead for 
Did you mean: 

Have I got news for you? No I haven't!

N/A

Have I got news for you? No I haven't!

There isn't any real problem, but I am wondering why the PlusNet News server is trying to access my local news server.

I finally managed to find out how to access the syslog output from my 715PVW that is running in NAT modes with firewall enabled and have been looking through the messages....

Apart from the usual attempts on port 137, 139 and so on, plus all the +Net customers in the range 81.174.XX.YY sending ICMP packets, I also noticed:
Blocked prot=6, 212.159.13.2:119>81.174.128.173:4626..... No existing session.
Messages like this typically appear every 5 minutes or so in groups of three or four.
My server is set to collect news from +Net every 3 hours, so I don't think these are spurious responses by the router.

So has anyone got any idea why +Net is trying to collect news from my server?

Geoff

PS In the Welcome message at the top of this forum, the link to Forum Guidelines is actually a Force9 link...
4 REPLIES
Community Veteran
Posts: 6,111
Thanks: 1
Registered: 05-04-2007

Re: Have I got news for you? No I haven't!

Quote
PS In the Welcome message at the top of this forum, the link to Forum Guidelines is actually a Force9 link...

Yes, Ian was twiddling around with a little system we use for making links, messed it up, but never fixed it... Wink

Thomas
jberry
Grafter
Posts: 1,886
Registered: 08-06-2007

Have I got news for you? No I haven't!

Hi there,

I am really not sure what would be causing this, but if you provide a section of firewall logs with the probes and put them in a ticket our Netwoks team will be able to take a look.

Regards,
N/A

Have I got news for you? No I haven't!

Thanks Josh,

In fact, after I thought about it a bit... "Blocked prot=6, 212.159.13.2:119>81.174.128.173:4626" surely indicates that it must have been a response to a request from here - otherwise it would have been trying to connect to my port 119 rather than 4626?

I think I'm going to do a bit more investigation at this end first.

Cheers

Geoff
Ianwild
Grafter
Posts: 3,835
Registered: 05-04-2007

Have I got news for you? No I haven't!

Hi Geoff,

The TCP responses are coming from the load balancing server here by the looks of it, rather than the news servers themselves. It looks like some sort of keep alive perhaps.

If you can identify a pattern to this It would really help us track down what is happening.

Cheers,

Ian