cancel
Showing results for 
Search instead for 
Did you mean: 

What is this? :-)

N/A

What is this? :-)

Hi All

I know that this is not an "attack" as such,but could someone that knows more about these things than I do please explain what in simple terms this means 'TCP ack packet attack': "Blocked: In TCP, 212.159.**.**:119->localhost:1458".It is of course a report from my firewall (Kerio),and everything I can find on the "web" about a "TCP ack packet" may as well be written in ancient Sanscrit for all the sense I can make of it.It seems by the IP address to be comming from "Plusnet",but what is it meant to do if anything,or what is the aim of "Plusnet" sending it (if that is the correct term).I do get them from a few other IP's.Not concerned just curious.

IanJ
2 REPLIES
N/A

RE: What is this? :-)

Hi Ian,

If you take a look at the link below, I am sure that you will be able to gain more information regarding this alert.

http://www.kerio.com/supp_kpf_manual.html

Let us know if you find anything!

Regards,

Dave

--
| David Scarpa...................Unmetered & ADSL solutions
| Technical Support.....................for Home & Business
| PlusNet Technologies Ltd............@ http://www.plus.net
+ ----- My Referrals - It pays to recommend PlusNet -----
N/A

RE: What is this? :-)

Hello Dave

> If you take a look at the link below, I am sure that you will be able to gain more information regarding this alert.
>
> http://www.kerio.com/supp_kpf_manual.html
>
> Let us know if you find anything!

I did find something,but not from the source that you suggested,and I quote it below.Not sure how you are going to react to the beginning of the second paragraph,but as in my case the last sentance applies then I guess it does not matter.But the explaination does make sense to me :-)

"The majority of the time these "attacks" are from a connection being
terminated by your PC before all of the data is received. For
example, if you stop a web page while it is loading in your browser,
you will see these because your browser will close the connection, but
the server will try to continue sending the rest of the page plus any
images not already completely sent, etc.

If you are getting these from the news server even when the connection
ends normally, then I would guess that the news server's software is
screwy. If you are receiving all of the messages properly, then just
ignore these in the log, they are benign"

Thanks for the reply

IanJ