cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

IMAP 14300

Anonymous
Not applicable

Re: IMAP 14300

‎08-06-2016 11:32 AM

Because I am packet capturing on a router's WAN interface, I first needed to restrict the internet addresses that I was monitoring, so any trace wasn't flooded with thousands of packets from my household's background internet traffic.

 

The addresses used for capturing Plusnet IMAP traffic were restricted to the following -

 

  • 212.159.8.87 which is the only address used by "imap.force9.net"

     

  • Subnets 84.93.229.0/24 and 84.93.238.0/24, which cover "mailc01.plus.net" to "mailc20.plus.net" which are the email servers that are known to send out the spurious port <14301> packets that we are trying to remove.

     

The actual packet trace is looking for ANY protocol, on ANY port number, either inbound or outbound, and restricted to the addresses mentioned.

 

 

As for understanding the trace itself -

 

  • At approximately 21:15, I started my email client and let it run.

 

  • At trace timestamp 21:16:57 I started a packet capture run.

 

  • At 21:20:06 I spent approximately a minute simply looking at various email folders within Thunderbird.

 

  • At 21:21:05 I stopped interacting with Thunderbird.

 

  • From 21:22:26 the spurious port <14301> packets start, and NO emails were received during this trace.

 

  • I'm guessing that at 21:26:31, that I might have a 5 minute mailbox polling time which may have gone looking for an update.

 

 

The question this raises for me is - are there any other Plusnet addresses which I need to be monitoring ? because the trace shows the spurious port <14301> ACK packets coming from the email servers, but we still don't know whether they arrive unsolicited, or whether they are in reply to some other Plusnet server address(es) which I am unaware of - and was therefore not monitoring .

 

I have only presented the simplified trace result here, as this gives the best visibility of the sequence of what actually happened.

I do also have more detailed (text) versions of the same capture, showing the TCP flags and internals of each packet, and a binary "capture.cap" file, if those are of any use.

 

Trace to follow in next post -

Message 31 of 46
(1,524 Views)
0 Thanks
Anonymous
Not applicable

Re: IMAP 14300

‎08-06-2016 11:37 AM

Enjoy !  Cool_smiley

 

21:16:57.783259 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 0
21:16:57.809357 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 0
21:16:57.812036 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 0
21:16:57.837951 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 233
21:16:57.839749 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 0
21:16:57.841155 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 43
21:16:57.866766 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 0
21:16:57.886477 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 16
21:16:57.888650 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 18
21:16:57.943409 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 264
21:16:57.946323 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 24
21:16:57.970975 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 67
21:16:57.972859 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 25
21:16:57.996381 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 328
21:16:58.000069 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 8
21:16:58.051795 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 22
21:16:58.089775 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 0
21:17:10.802370 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 0
21:17:10.829054 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 0
21:17:10.832420 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 0
21:17:10.860113 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 233
21:17:10.861827 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 0
21:17:10.862520 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 31
21:17:10.885478 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 0
21:17:10.903464 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 16
21:17:10.905502 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 18
21:17:10.953989 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 289
21:17:10.956146 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 24
21:17:10.981070 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 67
21:17:10.983092 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 25
21:17:11.012266 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 1438
21:17:11.014207 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 1438
21:17:11.015706 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 1438
21:17:11.017606 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 0
21:17:11.017658 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 1438
21:17:11.019152 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 1438
21:17:11.019866 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 0
21:17:11.043800 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 1438
21:17:11.045747 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 1438
21:17:11.046685 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 0
21:17:11.047244 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 1438
21:17:11.048721 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 1438
21:17:11.050692 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 1438
21:17:11.051277 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 0
21:17:11.052651 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 1438
21:17:11.053391 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 0
21:17:11.054606 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 1254
21:17:11.056808 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 0
21:17:11.062138 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 8
21:17:11.101064 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 22
21:17:11.141893 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 0
21:17:20.177959 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:17:20.208239 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 0
21:17:20.210896 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:17:20.236586 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 233
21:17:20.238311 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:17:20.239110 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 31
21:17:20.266135 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 0
21:17:20.281668 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 16
21:17:20.283912 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 23
21:17:20.344253 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 0
21:17:20.374096 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 309
21:17:20.376665 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 29
21:17:20.399682 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 0
21:17:20.400674 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 72
21:17:20.403730 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 25
21:17:20.428918 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.430851 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.432338 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.433820 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.436269 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.438172 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:17:20.438934 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:17:20.462917 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.464846 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.466814 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.468310 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.469804 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.470934 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:17:20.470956 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:17:20.472242 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.474208 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.475707 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.476422 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:17:20.477667 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.478235 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:17:20.479413 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.480339 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:17:20.496414 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.498350 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.499024 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:17:20.499839 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.501327 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.503238 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:17:20.503286 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.504765 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.506734 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 1438
21:17:20.507670 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 800
21:17:20.509630 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:17:20.509651 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:17:20.519947 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 47
21:17:20.580767 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 0
21:17:22.616635 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 29
21:17:22.620869 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 8
21:17:22.643707 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 0
21:17:22.661688 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 22
21:17:22.705942 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:20:06.401697 IP username.force9.co.uk.servexec > imap.force9.net.imap: tcp 6
21:20:06.429194 IP imap.force9.net.imap > username.force9.co.uk.servexec: tcp 0
21:20:09.852855 IP username.force9.co.uk.16443 > imap.force9.net.imap: tcp 6
21:20:09.875304 IP imap.force9.net.imap > username.force9.co.uk.16443: tcp 0
21:20:10.746737 IP username.force9.co.uk.23764 > imap.force9.net.imap: tcp 6
21:20:10.768672 IP imap.force9.net.imap > username.force9.co.uk.23764: tcp 0
21:20:11.589365 IP username.force9.co.uk.6452 > imap.force9.net.imap: tcp 6
21:20:11.611302 IP imap.force9.net.imap > username.force9.co.uk.6452: tcp 0
21:20:12.040778 IP username.force9.co.uk.16566 > imap.force9.net.imap: tcp 6
21:20:12.062934 IP imap.force9.net.imap > username.force9.co.uk.16566: tcp 0
21:20:13.570300 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 6
21:20:13.606246 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 21
21:20:13.607917 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 0
21:20:13.633865 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 8
21:20:13.668819 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 21
21:20:13.673935 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 24
21:20:13.696894 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 67
21:20:13.699289 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 29
21:20:13.721793 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 23
21:20:13.739292 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 9
21:20:13.777708 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 22
21:20:13.820042 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 0
21:20:14.028248 IP username.force9.co.uk.18016 > imap.force9.net.imap: tcp 6
21:20:14.051957 IP imap.force9.net.imap > username.force9.co.uk.18016: tcp 0
21:20:14.452367 IP username.force9.co.uk.9953 > imap.force9.net.imap: tcp 6
21:20:14.473727 IP imap.force9.net.imap > username.force9.co.uk.9953: tcp 0
21:20:14.892188 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 6
21:20:14.934971 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 21
21:20:14.936651 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:20:14.942297 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 8
21:20:14.983257 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 21
21:20:14.985902 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 29
21:20:15.009863 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 72
21:20:15.011864 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 30
21:20:15.036476 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 24
21:20:15.049298 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 9
21:20:15.087460 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 22
21:20:15.127281 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:20:15.714265 IP username.force9.co.uk.30798 > imap.force9.net.imap: tcp 6
21:20:15.736923 IP imap.force9.net.imap > username.force9.co.uk.30798: tcp 0
21:20:17.330655 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 6
21:20:17.371181 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 21
21:20:17.372990 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 0
21:20:17.382319 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 8
21:20:17.418476 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 21
21:20:17.420666 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 24
21:20:17.444846 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 67
21:20:17.446766 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 26
21:20:17.469004 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 23
21:20:17.480261 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 9
21:20:17.510386 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 22
21:20:17.552975 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 0
21:20:17.707881 IP username.force9.co.uk.10185 > imap.force9.net.imap: tcp 6
21:20:17.729910 IP imap.force9.net.imap > username.force9.co.uk.10185: tcp 0
21:20:18.171699 IP username.force9.co.uk.23914 > imap.force9.net.imap: tcp 6
21:20:18.192838 IP imap.force9.net.imap > username.force9.co.uk.23914: tcp 0
21:20:18.593632 IP username.force9.co.uk.29256 > imap.force9.net.imap: tcp 6
21:20:18.614918 IP imap.force9.net.imap > username.force9.co.uk.29256: tcp 0
21:20:25.991124 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 6
21:20:26.025020 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 22
21:20:26.026826 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 0
21:20:26.028256 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 9
21:20:26.063455 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 22
21:20:26.065515 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 25
21:20:26.088117 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 68
21:20:26.089930 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 27
21:20:26.112966 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 24
21:20:26.128728 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 9
21:20:26.163978 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 22
21:20:26.203259 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 0
21:20:29.513992 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 6
21:20:29.553904 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 22
21:20:29.555734 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:20:29.557700 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 9
21:20:29.603436 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 22
21:20:29.606082 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 30
21:20:29.628577 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 73
21:20:29.630540 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 30
21:20:29.653454 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 24
21:20:29.668791 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 9
21:20:29.709150 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 22
21:20:29.750589 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:20:30.805700 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 6
21:20:30.848162 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 22
21:20:30.850549 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 0
21:20:30.869866 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 9
21:20:30.910974 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 22
21:20:30.912938 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 25
21:20:30.937083 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 68
21:20:30.940243 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 30
21:20:30.966671 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 24
21:20:30.999881 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 9
21:20:31.035884 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 22
21:20:31.075374 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 0
21:20:44.543979 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 6
21:20:44.592451 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 22
21:20:44.594162 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 0
21:20:44.614498 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 9
21:20:44.676212 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 0
21:20:44.678666 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 22
21:20:44.680583 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 25
21:20:44.702837 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 0
21:20:44.703801 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 68
21:20:44.705950 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 30
21:20:44.728211 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 24
21:20:44.741655 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 9
21:20:44.780691 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 22
21:20:44.819484 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 0
21:20:45.775157 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 6
21:20:45.840851 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 0
21:20:45.862774 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 22
21:20:45.864541 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:20:45.865819 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 9
21:20:45.888655 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 0
21:20:45.913297 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 22
21:20:45.915232 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 30
21:20:45.941618 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 73
21:20:45.944295 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 30
21:20:45.967750 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 24
21:20:45.982866 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 9
21:20:46.020216 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 22
21:20:46.059484 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:20:47.274678 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 6
21:20:47.332185 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 22
21:20:47.335843 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:20:47.336654 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 9
21:20:47.396254 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 0
21:20:47.430763 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 22
21:20:47.432812 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 30
21:20:47.456383 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 0
21:20:47.457357 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 73
21:20:47.459202 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 30
21:20:47.481259 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 24
21:20:47.501702 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 9
21:20:47.545801 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 22
21:20:47.583454 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:20:50.161514 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 6
21:20:50.203267 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 22
21:20:50.204993 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 0
21:20:50.205665 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 9
21:20:50.243904 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 22
21:20:50.246627 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 25
21:20:50.269285 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 68
21:20:50.271280 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 27
21:20:50.294918 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 24
21:20:50.303064 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 9
21:20:50.344194 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 22
21:20:50.383453 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 0
21:20:54.483000 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 6
21:20:54.515391 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 22
21:20:54.517117 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 0
21:20:54.534583 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 9
21:20:54.572328 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 22
21:20:54.574602 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 25
21:20:54.598932 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 68
21:20:54.601329 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 27
21:20:54.627755 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 24
21:20:54.649763 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 9
21:20:54.682471 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 22
21:20:54.723570 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 0
21:20:56.157787 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 6
21:20:56.193994 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 22
21:20:56.196097 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:20:56.201714 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 9
21:20:56.247936 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 22
21:20:56.249927 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 30
21:20:56.273321 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 73
21:20:56.275405 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 30
21:20:56.299923 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 24
21:20:56.316705 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 9
21:20:56.355369 IP imap.force9.net.imap > username.force9.co.uk.4116: tcp 22
21:20:56.396044 IP username.force9.co.uk.4116 > imap.force9.net.imap: tcp 0
21:21:05.539440 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 6
21:21:05.580072 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 22
21:21:05.584949 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 0
21:21:05.585748 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 9
21:21:05.622450 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 22
21:21:05.625393 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 25
21:21:05.647613 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 68
21:21:05.650538 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 30
21:21:05.673446 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 24
21:21:05.696363 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 9
21:21:05.733581 IP imap.force9.net.imap > username.force9.co.uk.12792: tcp 22
21:21:05.775625 IP username.force9.co.uk.12792 > imap.force9.net.imap: tcp 0
21:22:26.003888 IP mailc10.plus.net.14301 > username.force9.co.uk.5842: tcp 36
21:22:26.005365 IP mailc10.plus.net.14301 > username.force9.co.uk.5842: tcp 0
21:22:26.232050 IP mailc10.plus.net.14301 > username.force9.co.uk.5842: tcp 36
21:22:26.455506 IP mailc12.plus.net.14301 > username.force9.co.uk.12291: tcp 36
21:22:26.456477 IP mailc12.plus.net.14301 > username.force9.co.uk.12291: tcp 0
21:22:26.488029 IP mailc16.plus.net.14301 > username.force9.co.uk.11020: tcp 36
21:22:26.488508 IP mailc16.plus.net.14301 > username.force9.co.uk.11020: tcp 0
21:22:26.684885 IP mailc12.plus.net.14301 > username.force9.co.uk.12291: tcp 36
21:22:26.695967 IP mailc10.plus.net.14301 > username.force9.co.uk.5842: tcp 36
21:22:26.718404 IP mailc16.plus.net.14301 > username.force9.co.uk.11020: tcp 36
21:22:27.020946 IP mailc20.plus.net.14301 > username.force9.co.uk.9037: tcp 36
21:22:27.021932 IP mailc20.plus.net.14301 > username.force9.co.uk.9037: tcp 0
21:22:27.148570 IP mailc12.plus.net.14301 > username.force9.co.uk.12291: tcp 36
21:22:27.182567 IP mailc16.plus.net.14301 > username.force9.co.uk.11020: tcp 36
21:22:27.251570 IP mailc20.plus.net.14301 > username.force9.co.uk.9037: tcp 36
21:22:27.583925 IP mailc10.plus.net.14301 > username.force9.co.uk.3166: tcp 36
21:22:27.585394 IP mailc10.plus.net.14301 > username.force9.co.uk.3166: tcp 0
21:22:27.624083 IP mailc10.plus.net.14301 > username.force9.co.uk.5842: tcp 36
21:22:27.715495 IP mailc20.plus.net.14301 > username.force9.co.uk.9037: tcp 36
21:22:27.812093 IP mailc10.plus.net.14301 > username.force9.co.uk.3166: tcp 36
21:22:28.076452 IP mailc12.plus.net.14301 > username.force9.co.uk.12291: tcp 36
21:22:28.110944 IP mailc16.plus.net.14301 > username.force9.co.uk.11020: tcp 36
21:22:28.229441 IP mailc10.plus.net.14301 > username.force9.co.uk.12283: tcp 36
21:22:28.230909 IP mailc10.plus.net.14301 > username.force9.co.uk.12283: tcp 0
21:22:28.276019 IP mailc10.plus.net.14301 > username.force9.co.uk.3166: tcp 36
21:22:28.459579 IP mailc10.plus.net.14301 > username.force9.co.uk.12283: tcp 36
21:22:28.644099 IP mailc20.plus.net.14301 > username.force9.co.uk.9037: tcp 36
21:22:28.660121 IP mailc06.plus.net.14301 > username.force9.co.uk.5932: tcp 36
21:22:28.662070 IP mailc06.plus.net.14301 > username.force9.co.uk.5932: tcp 0
21:22:28.694120 IP mailc12.plus.net.14301 > username.force9.co.uk.2338: tcp 36
21:22:28.695595 IP mailc12.plus.net.14301 > username.force9.co.uk.2338: tcp 0
21:22:28.890493 IP mailc06.plus.net.14301 > username.force9.co.uk.5932: tcp 36
21:22:28.924988 IP mailc10.plus.net.14301 > username.force9.co.uk.12283: tcp 36
21:22:28.926940 IP mailc12.plus.net.14301 > username.force9.co.uk.2338: tcp 36
21:22:29.028956 IP mailc12.plus.net.14301 > username.force9.co.uk.8696: tcp 36
21:22:29.030917 IP mailc12.plus.net.14301 > username.force9.co.uk.8696: tcp 0
21:22:29.204124 IP mailc10.plus.net.14301 > username.force9.co.uk.3166: tcp 36
21:22:29.260541 IP mailc12.plus.net.14301 > username.force9.co.uk.8696: tcp 36
21:22:29.353936 IP mailc06.plus.net.14301 > username.force9.co.uk.5932: tcp 36
21:22:29.389163 IP mailc12.plus.net.14301 > username.force9.co.uk.2338: tcp 36
21:22:29.484008 IP mailc10.plus.net.14301 > username.force9.co.uk.5842: tcp 36
21:22:29.725463 IP mailc12.plus.net.14301 > username.force9.co.uk.8696: tcp 36
21:22:29.741982 IP mailc09.plus.net.14301 > username.force9.co.uk.11897: tcp 36
21:22:29.742938 IP mailc09.plus.net.14301 > username.force9.co.uk.11897: tcp 0
21:22:29.852106 IP mailc10.plus.net.14301 > username.force9.co.uk.12283: tcp 36
21:22:29.883159 IP mailc09.plus.net.14301 > username.force9.co.uk.font-service: tcp 36
21:22:29.885114 IP mailc09.plus.net.14301 > username.force9.co.uk.font-service: tcp 0
21:22:29.936606 IP mailc12.plus.net.14301 > username.force9.co.uk.12291: tcp 36
21:22:29.961980 IP mailc07.plus.net.14301 > username.force9.co.uk.5245: tcp 36
21:22:29.962969 IP mailc07.plus.net.14301 > username.force9.co.uk.5245: tcp 0
21:22:29.970603 IP mailc16.plus.net.14301 > username.force9.co.uk.11020: tcp 36
21:22:29.977516 IP mailc09.plus.net.14301 > username.force9.co.uk.11897: tcp 36
21:22:30.075577 IP mailc16.plus.net.14301 > username.force9.co.uk.3346: tcp 36
21:22:30.077520 IP mailc16.plus.net.14301 > username.force9.co.uk.3346: tcp 0
21:22:30.117462 IP mailc09.plus.net.14301 > username.force9.co.uk.font-service: tcp 36
21:22:30.200488 IP mailc07.plus.net.14301 > username.force9.co.uk.5245: tcp 36
21:22:30.251993 IP mailc13.plus.net.14301 > username.force9.co.uk.5693: tcp 36
21:22:30.252023 IP mailc13.plus.net.14301 > username.force9.co.uk.5693: tcp 0
21:22:30.282040 IP mailc06.plus.net.14301 > username.force9.co.uk.5932: tcp 36
21:22:30.310620 IP mailc16.plus.net.14301 > username.force9.co.uk.3346: tcp 36
21:22:30.316533 IP mailc12.plus.net.14301 > username.force9.co.uk.2338: tcp 36
21:22:30.449585 IP mailc09.plus.net.14301 > username.force9.co.uk.11897: tcp 36
21:22:30.484557 IP mailc13.plus.net.14301 > username.force9.co.uk.5693: tcp 36
21:22:30.503540 IP mailc20.plus.net.14301 > username.force9.co.uk.9037: tcp 36
21:22:30.589514 IP mailc09.plus.net.14301 > username.force9.co.uk.font-service: tcp 36
21:22:30.652584 IP mailc12.plus.net.14301 > username.force9.co.uk.8696: tcp 36
21:22:30.680435 IP mailc07.plus.net.14301 > username.force9.co.uk.5245: tcp 36
21:22:30.782446 IP mailc16.plus.net.14301 > username.force9.co.uk.3346: tcp 36
21:22:30.956617 IP mailc13.plus.net.14301 > username.force9.co.uk.5693: tcp 36
21:22:31.064040 IP mailc10.plus.net.14301 > username.force9.co.uk.3166: tcp 36
21:22:31.393935 IP mailc09.plus.net.14301 > username.force9.co.uk.11897: tcp 36
21:22:31.534133 IP mailc09.plus.net.14301 > username.force9.co.uk.font-service: tcp 36
21:22:31.640096 IP mailc07.plus.net.14301 > username.force9.co.uk.5245: tcp 36
21:22:31.712022 IP mailc10.plus.net.14301 > username.force9.co.uk.12283: tcp 36
21:22:31.726571 IP mailc16.plus.net.14301 > username.force9.co.uk.3346: tcp 36
21:22:31.900525 IP mailc13.plus.net.14301 > username.force9.co.uk.5693: tcp 36
21:22:32.141965 IP mailc06.plus.net.14301 > username.force9.co.uk.5932: tcp 36
21:22:32.176456 IP mailc12.plus.net.14301 > username.force9.co.uk.2338: tcp 36
21:22:32.512528 IP mailc12.plus.net.14301 > username.force9.co.uk.8696: tcp 36
21:22:33.204113 IP mailc10.plus.net.14301 > username.force9.co.uk.5842: tcp 36
21:22:33.286137 IP mailc09.plus.net.14301 > username.force9.co.uk.11897: tcp 36
21:22:33.425594 IP mailc09.plus.net.14301 > username.force9.co.uk.font-service: tcp 36
21:22:33.564549 IP mailc07.plus.net.14301 > username.force9.co.uk.5245: tcp 36
21:22:33.618998 IP mailc16.plus.net.14301 > username.force9.co.uk.3346: tcp 36
21:22:33.656705 IP mailc12.plus.net.14301 > username.force9.co.uk.12291: tcp 36
21:22:33.691179 IP mailc16.plus.net.14301 > username.force9.co.uk.11020: tcp 36
21:22:33.793209 IP mailc13.plus.net.14301 > username.force9.co.uk.5693: tcp 36
21:22:34.219676 IP mailc20.plus.net.14301 > username.force9.co.uk.9037: tcp 36
21:22:34.780194 IP mailc10.plus.net.14301 > username.force9.co.uk.3166: tcp 36
21:22:35.436068 IP mailc10.plus.net.14301 > username.force9.co.uk.12283: tcp 36
21:22:35.862058 IP mailc06.plus.net.14301 > username.force9.co.uk.5932: tcp 36
21:22:35.896544 IP mailc12.plus.net.14301 > username.force9.co.uk.2338: tcp 36
21:22:36.233093 IP mailc12.plus.net.14301 > username.force9.co.uk.8696: tcp 36
21:22:37.074234 IP mailc09.plus.net.14301 > username.force9.co.uk.11897: tcp 36
21:22:37.209751 IP mailc09.plus.net.14301 > username.force9.co.uk.font-service: tcp 36
21:22:37.402669 IP mailc16.plus.net.14301 > username.force9.co.uk.3346: tcp 36
21:22:37.412519 IP mailc07.plus.net.14301 > username.force9.co.uk.5245: tcp 36
21:22:37.572668 IP mailc13.plus.net.14301 > username.force9.co.uk.5693: tcp 36
21:22:40.652162 IP mailc10.plus.net.14301 > username.force9.co.uk.5842: tcp 36
21:22:41.096641 IP mailc12.plus.net.14301 > username.force9.co.uk.12291: tcp 36
21:22:41.130631 IP mailc16.plus.net.14301 > username.force9.co.uk.11020: tcp 36
21:22:41.659603 IP mailc20.plus.net.14301 > username.force9.co.uk.9037: tcp 36
21:22:42.220138 IP mailc10.plus.net.14301 > username.force9.co.uk.3166: tcp 36
21:22:42.875758 IP mailc10.plus.net.14301 > username.force9.co.uk.12283: tcp 36
21:22:43.310128 IP mailc06.plus.net.14301 > username.force9.co.uk.5932: tcp 36
21:22:43.336723 IP mailc12.plus.net.14301 > username.force9.co.uk.2338: tcp 36
21:22:43.674256 IP mailc12.plus.net.14301 > username.force9.co.uk.8696: tcp 36
21:22:44.641307 IP mailc09.plus.net.14301 > username.force9.co.uk.11897: tcp 36
21:22:44.769673 IP mailc09.plus.net.14301 > username.force9.co.uk.font-service: tcp 36
21:22:44.970707 IP mailc16.plus.net.14301 > username.force9.co.uk.3346: tcp 36
21:22:45.100317 IP mailc07.plus.net.14301 > username.force9.co.uk.5245: tcp 36
21:22:45.140710 IP mailc13.plus.net.14301 > username.force9.co.uk.5693: tcp 36
21:22:55.532275 IP mailc10.plus.net.14301 > username.force9.co.uk.5842: tcp 36
21:22:55.976746 IP mailc12.plus.net.14301 > username.force9.co.uk.12291: tcp 36
21:22:55.994496 IP mailc16.plus.net.14301 > username.force9.co.uk.11020: tcp 36
21:22:56.555995 IP mailc20.plus.net.14301 > username.force9.co.uk.9037: tcp 36
21:22:57.100004 IP mailc10.plus.net.14301 > username.force9.co.uk.3166: tcp 36
21:22:57.771885 IP mailc10.plus.net.14301 > username.force9.co.uk.12283: tcp 36
21:22:58.189988 IP mailc06.plus.net.14301 > username.force9.co.uk.5932: tcp 36
21:22:58.216831 IP mailc12.plus.net.14301 > username.force9.co.uk.2338: tcp 36
21:22:58.568438 IP mailc12.plus.net.14301 > username.force9.co.uk.8696: tcp 36
21:22:59.777418 IP mailc09.plus.net.14301 > username.force9.co.uk.11897: tcp 36
21:22:59.907000 IP mailc09.plus.net.14301 > username.force9.co.uk.font-service: tcp 36
21:23:00.090799 IP mailc16.plus.net.14301 > username.force9.co.uk.3346: tcp 36
21:23:00.260798 IP mailc13.plus.net.14301 > username.force9.co.uk.5693: tcp 36
21:23:00.492398 IP mailc07.plus.net.14301 > username.force9.co.uk.5245: tcp 36
21:23:25.291782 IP mailc10.plus.net.14301 > username.force9.co.uk.5842: tcp 36
21:23:25.754727 IP mailc16.plus.net.14301 > username.force9.co.uk.11020: tcp 36
21:23:25.768752 IP mailc12.plus.net.14301 > username.force9.co.uk.12291: tcp 36
21:23:26.316706 IP mailc20.plus.net.14301 > username.force9.co.uk.9037: tcp 36
21:23:26.892262 IP mailc10.plus.net.14301 > username.force9.co.uk.3166: tcp 36
21:23:27.531867 IP mailc10.plus.net.14301 > username.force9.co.uk.12283: tcp 36
21:23:27.944785 IP mailc12.plus.net.14301 > username.force9.co.uk.2338: tcp 36
21:23:27.950200 IP mailc06.plus.net.14301 > username.force9.co.uk.5932: tcp 36
21:23:28.328913 IP mailc12.plus.net.14301 > username.force9.co.uk.8696: tcp 36
21:23:30.019315 IP mailc09.plus.net.14301 > username.force9.co.uk.11897: tcp 36
21:23:30.145693 IP mailc09.plus.net.14301 > username.force9.co.uk.font-service: tcp 36
21:23:30.362775 IP mailc16.plus.net.14301 > username.force9.co.uk.3346: tcp 36
21:23:30.533738 IP mailc13.plus.net.14301 > username.force9.co.uk.5693: tcp 36
21:23:31.308355 IP mailc07.plus.net.14301 > username.force9.co.uk.5245: tcp 36
21:26:31.562194 IP username.force9.co.uk.49933 > imap.force9.net.imap: tcp 6
21:26:31.585545 IP imap.force9.net.imap > username.force9.co.uk.49933: tcp 0

 Cool_smiley

Message 32 of 46
(1,522 Views)
0 Thanks
bobpullen
Community Gaffer
Community Gaffer
Posts: 16,887
Thanks: 4,979
Fixes: 316
Registered: ‎04-04-2007

Re: IMAP 14300

‎08-06-2016 12:00 PM

Nibiru wrote:

  • 212.159.8.87 which is the only address used by "imap.force9.net"

Nothing from 212.159.9.87 then?

>nslookup imap.force9.net

Non-authoritative answer:
Name:    imap.force9.net
Addresses:  212.159.8.87
          212.159.9.87
@Anonymous wrote:

I do also have more detailed (text) versions of the same capture, showing the TCP flags and internals of each packet, and a binary "capture.cap" file, if those are of any use.

I'd be interested in seeing the binary file if you've some method of getting it to me and don't mind sharing it.

Bob Pullen
Plusnet Product Team
If I've been helpful then please give thanks ⤵
Message 33 of 46
(1,514 Views)
0 Thanks
Anonymous
Not applicable

Re: IMAP 14300

‎08-06-2016 12:24 PM

Oh, well spotted !,  somehow I missed 212.159.9.87  Embarrassed

 

I will try and capture another trace including 212.159.9.87, probably this evening.

 

I will then see if I can upload the binary.cap file somewhere that you can read it from.

Message 34 of 46
(1,511 Views)
Simon
Grafter
Posts: 64
Thanks: 3
Registered: ‎01-08-2007

Re: IMAP 14300

‎08-06-2016 1:57 PM

.. yes I believe the active-IP-blocker used the logs and yes if there was a pass rule it wouldn't get blocked, though a whitelist would be simpler (would just have to know all source IPs) as can't add rules based on source port, only destination port (would also need all source IPs).

Anyhoo.. not a problem at the mo as v3.1 smoothie has no active-IP-blocker..

WRT a previous comment about ignore rules, I think the "don't log" option doesn't block.. though would need to test if that's my only option..

Message 35 of 46
(1,500 Views)
0 Thanks
Anonymous
Not applicable

Re: IMAP 14300

‎08-06-2016 4:15 PM - edited ‎08-06-2016 10:00 PM

OK, have replicated my previous packet capture setup, but now includes the other IMAP server 212.159.9.87  Roll_eyes

 

This time, I've created a single new Plusnet (Force9) IMAP mailbox, and a fresh Thunderbird IMAP installation which only contains this new mailbox, with a check for new message poll time of 5 minutes.

 

The real-world interaction which occurred during the trace capture was as follows -

 

    • 14:30 : Opened Thunderbird.

 

    • 14:32 : Started packet capture.

 

    • 14:33:00 : Composed message (to self), and sent it via Force9 SMTP.

 

    • 14:34:00 : Pressed [Get Messages] and received above message and read it.

 

    • 14:35:00 : Clicked on email folders, then stopped pressing buttons at this time.

 

    • For the remaining time, I had no interaction with Thunderbird, and left it to check for messages every 5 minutes.

 

    • 14:59 : Stopped the packet trace

 

 

Trace to follow -

Message 36 of 46
(1,492 Views)
0 Thanks
Anonymous
Not applicable

Re: IMAP 14300

‎08-06-2016 4:21 PM 

14:33:23.630560 IP username.force9.co.uk.23282 > imap.force9.net.imap: tcp 0
14:33:23.650254 IP imap.force9.net.imap > username.force9.co.uk.23282: tcp 0
14:33:23.653976 IP username.force9.co.uk.23282 > imap.force9.net.imap: tcp 0
14:33:23.676376 IP imap.force9.net.imap > username.force9.co.uk.23282: tcp 233
14:33:23.680505 IP username.force9.co.uk.23282 > imap.force9.net.imap: tcp 0
14:33:23.680526 IP username.force9.co.uk.23282 > imap.force9.net.imap: tcp 36
14:33:23.699272 IP imap.force9.net.imap > username.force9.co.uk.23282: tcp 0
14:33:23.738704 IP imap.force9.net.imap > username.force9.co.uk.23282: tcp 16
14:33:23.741609 IP username.force9.co.uk.23282 > imap.force9.net.imap: tcp 37
14:33:23.759401 IP imap.force9.net.imap > username.force9.co.uk.23282: tcp 0
14:33:23.771703 IP imap.force9.net.imap > username.force9.co.uk.23282: tcp 6
14:33:23.773625 IP username.force9.co.uk.23282 > imap.force9.net.imap: tcp 394
14:33:23.774436 IP username.force9.co.uk.23282 > imap.force9.net.imap: tcp 2
14:33:23.820629 IP username.force9.co.uk.23282 > imap.force9.net.imap: tcp 2
14:33:23.830853 IP imap.force9.net.imap > username.force9.co.uk.23282: tcp 0
14:33:23.832314 IP imap.force9.net.imap > username.force9.co.uk.23282: tcp 41
14:33:23.837733 IP imap.force9.net.imap > username.force9.co.uk.23282: tcp 0
14:33:23.872741 IP username.force9.co.uk.23282 > imap.force9.net.imap: tcp 0
14:33:27.225756 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 0
14:33:27.243964 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 0
14:33:27.247378 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 0
14:33:27.269831 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 233
14:33:27.273753 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 0
14:33:27.273774 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 36
14:33:27.292727 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 0
14:33:27.311956 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 16
14:33:27.314824 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 23
14:33:27.372319 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 0
14:33:27.382946 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 248
14:33:27.385840 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 29
14:33:27.404338 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 0
14:33:27.407805 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 72
14:33:27.413394 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 25
14:33:27.433419 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 122
14:33:27.436955 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 181
14:33:27.459814 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 487
14:33:27.484061 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 8
14:33:27.533020 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 22
14:33:27.572845 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 0
14:33:44.387728 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 6
14:33:44.405059 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 0
14:33:44.423032 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:33:44.424901 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:33:44.424923 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 10
14:33:44.458520 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 23
14:33:44.460436 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 25
14:33:44.479953 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 68
14:33:44.482424 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 26
14:33:44.500640 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 24
14:33:44.504627 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 9
14:33:44.537102 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:33:44.576650 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:33:59.470080 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 6
14:33:59.508147 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 46
14:33:59.510451 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:33:59.510472 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 9
14:33:59.557164 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:33:59.559083 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 25
14:33:59.583786 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 68
14:33:59.587136 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 26
14:33:59.605208 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 59
14:33:59.609696 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 182
14:33:59.635333 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 491
14:33:59.677101 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:33:59.708405 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 46
14:33:59.726201 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 49
14:33:59.728520 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:33:59.748001 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 1198
14:33:59.750846 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:33:59.804855 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 112
14:33:59.823286 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 200
14:33:59.826785 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:33:59.844198 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 39
14:33:59.847386 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:33:59.853016 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 9
14:33:59.892744 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:33:59.935953 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:34:07.623268 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 6
14:34:07.661855 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:34:07.664214 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:34:07.677927 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 31
14:34:07.702255 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 57
14:34:07.704407 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 9
14:34:07.738470 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:34:07.787542 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:34:15.143194 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 6
14:34:15.177415 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:34:15.179926 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:34:15.199931 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 31
14:34:15.222994 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 65
14:34:15.225339 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 9
14:34:15.266340 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:34:15.306134 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:34:17.116437 IP mailc15.plus.net.14301 > username.force9.co.uk.15579: tcp 51
14:34:17.351973 IP mailc15.plus.net.14301 > username.force9.co.uk.15579: tcp 51
14:34:17.821573 IP mailc15.plus.net.14301 > username.force9.co.uk.15579: tcp 51
14:34:18.765466 IP mailc15.plus.net.14301 > username.force9.co.uk.15579: tcp 51
14:34:20.658169 IP mailc15.plus.net.14301 > username.force9.co.uk.15579: tcp 51
14:34:24.437614 IP mailc15.plus.net.14301 > username.force9.co.uk.15579: tcp 51
14:34:32.005666 IP mailc15.plus.net.14301 > username.force9.co.uk.15579: tcp 51
14:34:47.139602 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 0
14:34:47.141763 IP mailc15.plus.net.14301 > username.force9.co.uk.15579: tcp 51
14:34:47.162442 IP imap.force9.net.imap > username.force9.co.uk.25714: tcp 0
14:34:47.165643 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 0
14:34:47.186863 IP imap.force9.net.imap > username.force9.co.uk.25714: tcp 233
14:34:47.190975 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 0
14:34:47.275260 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 36
14:34:47.292805 IP imap.force9.net.imap > username.force9.co.uk.25714: tcp 0
14:34:47.343291 IP imap.force9.net.imap > username.force9.co.uk.25714: tcp 16
14:34:47.346421 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 0
14:34:47.350276 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 24
14:34:47.369895 IP imap.force9.net.imap > username.force9.co.uk.25714: tcp 0
14:34:47.429793 IP imap.force9.net.imap > username.force9.co.uk.25714: tcp 248
14:34:47.432002 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 30
14:34:47.449968 IP imap.force9.net.imap > username.force9.co.uk.25714: tcp 0
14:34:47.454424 IP imap.force9.net.imap > username.force9.co.uk.25714: tcp 73
14:34:47.464652 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 8
14:34:47.512820 IP imap.force9.net.imap > username.force9.co.uk.25714: tcp 22
14:34:47.555759 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 0
14:34:48.114171 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 6
14:34:48.168416 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 0
14:34:48.176298 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 21
14:34:48.178828 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 0
14:34:48.182627 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 8
14:34:48.199472 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 0
14:34:48.215990 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 21
14:34:48.219139 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 29
14:34:48.244802 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 72
14:34:48.248182 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 26
14:34:48.268446 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 24
14:34:48.284207 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 9
14:34:48.317998 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 22
14:34:48.359135 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 0
14:34:49.092047 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 6
14:34:49.126834 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:34:49.129153 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:34:49.286570 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 9
14:34:49.327401 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:34:49.331530 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:34:49.331552 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 25
14:34:49.351303 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 68
14:34:49.354093 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 26
14:34:49.372000 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 24
14:34:49.381245 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 9
14:34:49.414376 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:34:49.454829 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:34:50.249630 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 6
14:34:50.284085 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 22
14:34:50.288698 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 0
14:34:50.361175 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 9
14:34:50.403325 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 22
14:34:50.405712 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 0
14:34:50.405722 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 30
14:34:50.425531 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 73
14:34:50.427951 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 26
14:34:50.445967 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 24
14:34:50.456236 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 9
14:34:50.492522 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 22
14:34:50.534430 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 0
14:34:51.324379 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 6
14:34:51.360540 IP imap.force9.net.imap > username.force9.co.uk.25714: tcp 21
14:34:51.362968 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 0
14:34:51.389947 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 8
14:34:51.429995 IP imap.force9.net.imap > username.force9.co.uk.25714: tcp 21
14:34:51.431865 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 30
14:34:51.450463 IP imap.force9.net.imap > username.force9.co.uk.25714: tcp 73
14:34:51.465691 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 8
14:34:51.502927 IP imap.force9.net.imap > username.force9.co.uk.25714: tcp 22
14:34:51.542454 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 0
14:34:52.302282 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 6
14:34:52.356384 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 0
14:34:52.408368 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 22
14:34:52.411407 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 0
14:34:52.411417 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 9
14:34:52.429815 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 0
14:34:52.502501 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 22
14:34:52.507125 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 30
14:34:52.524906 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 0
14:34:52.526397 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 73
14:34:52.528591 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 26
14:34:52.546848 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 24
14:34:52.559959 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 9
14:34:52.607469 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 22
14:34:52.646512 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 0
14:34:53.336935 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 6
14:34:53.374934 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:34:53.377340 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:34:53.534220 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 9
14:34:53.575966 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:34:53.580150 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:34:53.580172 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 25
14:34:53.598896 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 68
14:34:53.605274 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 26
14:34:53.624007 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 24
14:34:53.633952 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 9
14:34:53.677972 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:34:53.722044 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:34:54.323078 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 6
14:34:54.370061 IP imap.force9.net.imap > username.force9.co.uk.25714: tcp 21
14:34:54.373586 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 0
14:34:54.414798 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 8
14:34:54.472059 IP imap.force9.net.imap > username.force9.co.uk.25714: tcp 0
14:34:54.500394 IP imap.force9.net.imap > username.force9.co.uk.25714: tcp 21
14:34:54.503439 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 0
14:34:54.504223 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 31
14:34:54.522073 IP imap.force9.net.imap > username.force9.co.uk.25714: tcp 0
14:34:54.523557 IP imap.force9.net.imap > username.force9.co.uk.25714: tcp 74
14:34:54.531961 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 9
14:34:54.595509 IP imap.force9.net.imap > username.force9.co.uk.25714: tcp 0
14:34:54.624060 IP imap.force9.net.imap > username.force9.co.uk.25714: tcp 22
14:34:54.662534 IP username.force9.co.uk.25714 > imap.force9.net.imap: tcp 0
14:34:57.147532 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 6
14:34:57.179528 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:34:57.184132 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:34:57.353564 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 9
14:34:57.405945 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:34:57.407859 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:34:57.407880 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 25
14:34:57.427874 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 68
14:34:57.430431 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 26
14:34:57.448085 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 24
14:34:57.465351 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 9
14:34:57.504501 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:34:57.546599 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:34:58.158053 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 6
14:34:58.204477 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 22
14:34:58.206842 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 0
14:34:58.266298 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 9
14:34:58.302534 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 22
14:34:58.304533 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 0
14:34:58.304554 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 30
14:34:58.323481 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 73
14:34:58.325280 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 26
14:34:58.342938 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 24
14:34:58.363526 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 9
14:34:58.405018 IP imap.force9.net.imap > username.force9.co.uk.1328: tcp 22
14:34:58.447440 IP username.force9.co.uk.1328 > imap.force9.net.imap: tcp 0
14:34:59.470752 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 6
14:34:59.507563 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:34:59.512820 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:34:59.657078 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 9
14:34:59.709119 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:34:59.711356 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:34:59.711377 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 25
14:34:59.730544 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 68
14:34:59.732459 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 26
14:34:59.750494 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 24
14:34:59.770234 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 9
14:34:59.802494 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:34:59.842722 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:35:00.404140 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 6
14:35:00.441584 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:35:00.443963 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:35:00.443984 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 9
14:35:00.481011 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:35:00.485448 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 25
14:35:00.503448 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 68
14:35:00.506218 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 26
14:35:00.525122 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 24
14:35:00.531427 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 9
14:35:00.584500 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:35:00.626771 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:35:17.445266 IP mailc15.plus.net.14301 > username.force9.co.uk.15579: tcp 51
14:35:22.544348 IP mailc17.plus.net.14301 > username.force9.co.uk.14980: tcp 51
14:35:22.545308 IP mailc17.plus.net.14301 > username.force9.co.uk.14980: tcp 36
14:35:22.775217 IP mailc17.plus.net.14301 > username.force9.co.uk.14980: tcp 51
14:35:23.239374 IP mailc17.plus.net.14301 > username.force9.co.uk.14980: tcp 51
14:35:24.167734 IP mailc17.plus.net.14301 > username.force9.co.uk.14980: tcp 51
14:35:26.027439 IP mailc17.plus.net.14301 > username.force9.co.uk.14980: tcp 51
14:35:29.751455 IP mailc17.plus.net.14301 > username.force9.co.uk.14980: tcp 51
14:35:37.191377 IP mailc17.plus.net.14301 > username.force9.co.uk.14980: tcp 51
14:35:52.071269 IP mailc17.plus.net.14301 > username.force9.co.uk.14980: tcp 51
14:36:17.989446 IP mailc15.plus.net.14301 > username.force9.co.uk.15579: tcp 51
14:36:21.863028 IP mailc17.plus.net.14301 > username.force9.co.uk.14980: tcp 51
14:38:18.053590 IP mailc15.plus.net.14301 > username.force9.co.uk.15579: tcp 51
14:38:51.985222 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 6
14:38:52.035537 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:38:52.037676 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:38:52.037696 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 9
14:38:52.083572 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:38:52.085445 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 25
14:38:52.105992 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 68
14:38:52.109256 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 26
14:38:52.134587 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 24
14:38:52.140042 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 9
14:38:52.181398 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:38:52.222866 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:40:18.373474 IP mailc15.plus.net.14301 > username.force9.co.uk.15579: tcp 51
14:42:18.693604 IP mailc15.plus.net.14301 > username.force9.co.uk.15579: tcp 51
14:43:54.941769 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 6
14:43:54.997858 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 0
14:43:55.044918 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:43:55.047171 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:43:55.047182 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 10
14:43:55.065357 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 0
14:43:55.154781 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 23
14:43:55.156896 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 25
14:43:55.174750 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 0
14:43:55.188803 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 68
14:43:55.191369 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 26
14:43:55.209728 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 24
14:43:55.213994 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 9
14:43:55.269854 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 0
14:43:55.329713 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:43:55.369035 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:44:19.014234 IP mailc15.plus.net.14301 > username.force9.co.uk.15579: tcp 51
14:46:19.333143 IP mailc15.plus.net.14301 > username.force9.co.uk.15579: tcp 51
14:48:19.653291 IP mailc15.plus.net.14301 > username.force9.co.uk.15579: tcp 51
14:48:43.106778 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 6
14:48:43.124404 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 0
14:48:43.754885 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:48:43.757143 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:48:43.757153 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 9
14:48:43.776081 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 0
14:48:43.939432 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:48:43.944254 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 25
14:48:43.963310 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 0
14:48:44.021468 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 68
14:48:44.024200 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 26
14:48:44.041422 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 0
14:48:44.041447 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 24
14:48:44.046205 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 9
14:48:44.102032 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 0
14:48:44.172982 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 22
14:48:44.213037 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:50:17.635276 IP mailc15.plus.net.14301 > username.force9.co.uk.15579: tcp 36
14:53:47.340163 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 6
14:53:47.357285 IP imap.force9.net.imap > username.force9.co.uk.37262: tcp 0
14:53:47.396236 IP username.force9.co.uk.43118 > imap.force9.net.imap: tcp 0
14:53:47.414214 IP imap.force9.net.imap > username.force9.co.uk.43118: tcp 0
14:53:47.417844 IP username.force9.co.uk.43118 > imap.force9.net.imap: tcp 0
14:53:47.438877 IP imap.force9.net.imap > username.force9.co.uk.43118: tcp 233
14:53:47.441587 IP username.force9.co.uk.43118 > imap.force9.net.imap: tcp 0
14:53:47.442593 IP username.force9.co.uk.43118 > imap.force9.net.imap: tcp 36
14:53:47.460764 IP imap.force9.net.imap > username.force9.co.uk.43118: tcp 0
14:53:52.778896 IP imap.force9.net.imap > username.force9.co.uk.43118: tcp 16
14:53:52.781774 IP username.force9.co.uk.43118 > imap.force9.net.imap: tcp 18
14:53:52.800324 IP imap.force9.net.imap > username.force9.co.uk.43118: tcp 0
14:53:53.091328 IP imap.force9.net.imap > username.force9.co.uk.43118: tcp 248
14:53:53.093587 IP username.force9.co.uk.43118 > imap.force9.net.imap: tcp 24
14:53:53.112003 IP imap.force9.net.imap > username.force9.co.uk.43118: tcp 0
14:53:53.134421 IP imap.force9.net.imap > username.force9.co.uk.43118: tcp 67
14:53:53.142954 IP username.force9.co.uk.43118 > imap.force9.net.imap: tcp 25
14:53:53.161282 IP imap.force9.net.imap > username.force9.co.uk.43118: tcp 122
14:53:53.165812 IP username.force9.co.uk.43118 > imap.force9.net.imap: tcp 8
14:53:53.223859 IP imap.force9.net.imap > username.force9.co.uk.43118: tcp 0
14:53:53.381285 IP imap.force9.net.imap > username.force9.co.uk.43118: tcp 22
14:53:53.421328 IP username.force9.co.uk.43118 > imap.force9.net.imap: tcp 0
14:58:40.613855 IP username.force9.co.uk.43118 > imap.force9.net.imap: tcp 6
14:58:40.630954 IP imap.force9.net.imap > username.force9.co.uk.43118: tcp 0
14:58:40.683935 IP imap.force9.net.imap > username.force9.co.uk.43118: tcp 21
14:58:40.685967 IP username.force9.co.uk.43118 > imap.force9.net.imap: tcp 0
14:58:40.685989 IP username.force9.co.uk.43118 > imap.force9.net.imap: tcp 8
14:58:40.703642 IP imap.force9.net.imap > username.force9.co.uk.43118: tcp 0
14:58:40.757584 IP imap.force9.net.imap > username.force9.co.uk.43118: tcp 21
14:58:40.760138 IP username.force9.co.uk.43118 > imap.force9.net.imap: tcp 24
14:58:40.778034 IP imap.force9.net.imap > username.force9.co.uk.43118: tcp 0
14:58:40.784461 IP imap.force9.net.imap > username.force9.co.uk.43118: tcp 67
14:58:40.786878 IP username.force9.co.uk.43118 > imap.force9.net.imap: tcp 25
14:58:40.804901 IP imap.force9.net.imap > username.force9.co.uk.43118: tcp 23
14:58:40.808840 IP username.force9.co.uk.43118 > imap.force9.net.imap: tcp 9
14:58:40.864018 IP imap.force9.net.imap > username.force9.co.uk.43118: tcp 0
14:58:40.867960 IP imap.force9.net.imap > username.force9.co.uk.43118: tcp 22
14:58:40.909155 IP username.force9.co.uk.43118 > imap.force9.net.imap: tcp 0
Message 37 of 46
(1,491 Views)
bobpullen
Community Gaffer
Community Gaffer
Posts: 16,887
Thanks: 4,979
Fixes: 316
Registered: ‎04-04-2007

Re: IMAP 14300

‎09-06-2016 1:58 PM

Thanks for that (and the PM). I'll endeavour to take a proper look at it when I get a bit of time to do so.

Bob Pullen
Plusnet Product Team
If I've been helpful then please give thanks ⤵
Message 38 of 46
(1,466 Views)
0 Thanks
Anonymous
Not applicable

Re: IMAP 14300

‎09-06-2016 2:28 PM - edited ‎09-06-2016 2:31 PM

@bobpullen wrote:

because the TCP packets that are being blocked are ACK packets suggesting they're in response to requests that originated from your machine.

Assuming the <14301> packets are not unsolicited, then that is the next best rational explanation.  If they are unsolicited, then I'm never going to be able to capture them !.

 

Because in the above packet capture traces, the <14301> packet destination port numbers don't correspond to anything my PC has sent (to the limited range of addresses monitored), can you have a think about whether there are any other Plusnet addresses which might be being accessed which could invoke these responses ?.

 

If it was happening all the time, then my suspects would be NTP, or a gateway PING monitor, but not DNS (as I never use Plusnet DNS !)

However the <14301> packets ONLY appear when an IMAP email client has been run locally, so it is definitely email related. I wonder therefore whether the Plusnet email VIP mapping is not as we think ?

 

What I need is some more addresses to monitor, to see if I can match the <14301> packet destination port numbers, to something NATed coming from my network ?

Message 39 of 46
(1,463 Views)
0 Thanks
spraxyt
Resting Legend
Posts: 10,063
Thanks: 674
Fixes: 75
Registered: ‎06-04-2007

Re: IMAP 14300

‎09-06-2016 5:12 PM

I'm rather rusty with TCP keepalives, but don't such probes *originate* as unsolicited zero-data-length ACK packets? If that's what they are the load balancer should be substitutung its own IP before sending them on.

David
Message 40 of 46
(1,453 Views)
0 Thanks
Anonymous
Not applicable

Re: IMAP 14300

‎09-06-2016 9:24 PM

I have no idea about TCP keepalives.  Undecided

 

However taking your suggestion on face value, and just from observation, every instance of the rogue <14301> packets is preceded by a zero length packet from the email client to the imap server -

14:48:44.213037 IP username.force9.co.uk.37262 > imap.force9.net.imap: tcp 0
14:50:17.635276 IP mailc15.plus.net.14301 > username.force9.co.uk.15579: tcp 36

The question is - why when the outgoing source port number is 37262, is the reply destination port number different, 15579 in this instance.  Maybe that's the fault ?

 

If it helps, this is the more detailed view of those two TCP packets -

14:48:44.213037 IP (tos 0x0, ttl 63, id 18679, offset 0, flags [DF], proto TCP (6), length 40)
    username.force9.co.uk.37262 > imap.force9.net.imap: Flags [.], cksum 0x2525 (correct), seq 1184, ack 3829, win 295, length 0


14:50:17.635276 IP (tos 0x80, ttl 54, id 30474, offset 0, flags [DF], proto TCP (6), length 76)
    mailc15.plus.net.14301 > username.force9.co.uk.15579: Flags [FP.], cksum 0x168d (correct), seq 51:87, ack 1, win 115, length 36

 

However, having putting together the above, I just realized that the apparent reply occurs more than a minute after the zero length outgoing packet, which seems somewhat unlikely and possibly just a coincidence.

So perhaps a red herring .  Embarrassed

Message 41 of 46
(1,444 Views)
0 Thanks
Simon
Grafter
Posts: 64
Thanks: 3
Registered: ‎01-08-2007

Re: IMAP 14300

‎01-07-2016 4:35 PM

Still happening to me..

14:50:08 kernel Denied-by-filter:badtraffic src=84.93.238.201 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=50 ID=19354 DF PROTO=TCP SPT=14300 DPT=15280 WINDOW=115 RES=0x00 ACK PSH URGP=0
14:50:08 kernel Denied-by-filter:badtraffic src=84.93.238.201 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=50 ID=19356 DF PROTO=TCP SPT=14300 DPT=15280 WINDOW=115 RES=0x00 ACK PSH URGP=0
14:50:09 kernel Denied-by-filter:badtraffic src=84.93.238.201 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=50 ID=19357 DF PROTO=TCP SPT=14300 DPT=15280 WINDOW=115 RES=0x00 ACK PSH URGP=0
14:50:10 kernel Denied-by-filter:badtraffic src=84.93.238.201 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=50 ID=19358 DF PROTO=TCP SPT=14300 DPT=15280 WINDOW=115 RES=0x00 ACK PSH URGP=0
14:50:13 kernel Denied-by-filter:badtraffic src=84.93.238.201 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=50 ID=19359 DF PROTO=TCP SPT=14300 DPT=15280 WINDOW=115 RES=0x00 ACK PSH URGP=0
14:50:19 kernel Denied-by-filter:badtraffic src=84.93.238.201 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=50 ID=19360 DF PROTO=TCP SPT=14300 DPT=15280 WINDOW=115 RES=0x00 ACK PSH URGP=0
14:50:31 kernel Denied-by-filter:badtraffic src=84.93.238.201 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=50 ID=19361 DF PROTO=TCP SPT=14300 DPT=15280 WINDOW=115 RES=0x00 ACK PSH URGP=0
14:50:54 kernel Denied-by-filter:badtraffic src=84.93.238.201 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=50 ID=19362 DF PROTO=TCP SPT=14300 DPT=15280 WINDOW=115 RES=0x00 ACK PSH URGP=0
14:51:40 kernel Denied-by-filter:badtraffic src=84.93.238.201 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=50 ID=19363 DF PROTO=TCP SPT=14300 DPT=15280 WINDOW=115 RES=0x00 ACK PSH URGP=0
15:20:06 kernel Denied-by-filter:badtraffic src=84.93.238.228 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=34403 DF PROTO=TCP SPT=14300 DPT=8532 WINDOW=115 RES=0x00 ACK PSH URGP=0
15:20:06 kernel Denied-by-filter:badtraffic src=84.93.238.228 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=34405 DF PROTO=TCP SPT=14300 DPT=8532 WINDOW=115 RES=0x00 ACK PSH URGP=0
15:20:06 kernel Denied-by-filter:badtraffic src=84.93.238.228 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=34406 DF PROTO=TCP SPT=14300 DPT=8532 WINDOW=115 RES=0x00 ACK PSH URGP=0
15:20:07 kernel Denied-by-filter:badtraffic src=84.93.238.228 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=34407 DF PROTO=TCP SPT=14300 DPT=8532 WINDOW=115 RES=0x00 ACK PSH URGP=0
15:20:10 kernel Denied-by-filter:badtraffic src=84.93.238.228 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=34408 DF PROTO=TCP SPT=14300 DPT=8532 WINDOW=115 RES=0x00 ACK PSH URGP=0
15:20:14 kernel Denied-by-filter:badtraffic src=84.93.238.228 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=34409 DF PROTO=TCP SPT=14300 DPT=8532 WINDOW=115 RES=0x00 ACK PSH URGP=0
15:20:23 kernel Denied-by-filter:badtraffic src=84.93.238.228 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=34410 DF PROTO=TCP SPT=14300 DPT=8532 WINDOW=115 RES=0x00 ACK PSH URGP=0
15:20:40 kernel Denied-by-filter:badtraffic src=84.93.238.228 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=34411 DF PROTO=TCP SPT=14300 DPT=8532 WINDOW=115 RES=0x00 ACK PSH URGP=0
15:21:15 kernel Denied-by-filter:badtraffic src=84.93.238.228 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=34412 DF PROTO=TCP SPT=14300 DPT=8532 WINDOW=115 RES=0x00 ACK PSH URGP=0
15:52:16 kernel Denied-by-filter:badtraffic src=84.93.238.136 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=64936 DF PROTO=TCP SPT=14300 DPT=9493 WINDOW=115 RES=0x00 ACK PSH URGP=0
15:52:18 kernel Denied-by-filter:badtraffic src=84.93.238.136 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=64938 DF PROTO=TCP SPT=14300 DPT=9493 WINDOW=115 RES=0x00 ACK PSH URGP=0
15:52:22 kernel Denied-by-filter:badtraffic src=84.93.238.136 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=64939 DF PROTO=TCP SPT=14300 DPT=9493 WINDOW=115 RES=0x00 ACK PSH URGP=0
15:52:31 kernel Denied-by-filter:badtraffic src=84.93.238.136 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=64940 DF PROTO=TCP SPT=14300 DPT=9493 WINDOW=115 RES=0x00 ACK PSH URGP=0
15:52:49 kernel Denied-by-filter:badtraffic src=84.93.238.136 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=64941 DF PROTO=TCP SPT=14300 DPT=9493 WINDOW=115 RES=0x00 ACK PSH URGP=0
15:53:25 kernel Denied-by-filter:badtraffic src=84.93.238.136 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=64942 DF PROTO=TCP SPT=14300 DPT=9493 WINDOW=115 RES=0x00 ACK PSH URGP=0
16:07:08 kernel Denied-by-filter:badtraffic src=84.93.238.228 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=24174 DF PROTO=TCP SPT=14300 DPT=6176 WINDOW=115 RES=0x00 ACK PSH URGP=0
16:07:09 kernel Denied-by-filter:badtraffic src=84.93.238.228 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=24176 DF PROTO=TCP SPT=14300 DPT=6176 WINDOW=115 RES=0x00 ACK PSH URGP=0
16:07:11 kernel Denied-by-filter:badtraffic src=84.93.238.228 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=24177 DF PROTO=TCP SPT=14300 DPT=6176 WINDOW=115 RES=0x00 ACK PSH URGP=0
16:07:15 kernel Denied-by-filter:badtraffic src=84.93.238.228 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=24178 DF PROTO=TCP SPT=14300 DPT=6176 WINDOW=115 RES=0x00 ACK PSH URGP=0
16:07:24 kernel Denied-by-filter:badtraffic src=84.93.238.228 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=24179 DF PROTO=TCP SPT=14300 DPT=6176 WINDOW=115 RES=0x00 ACK PSH URGP=0
16:07:41 kernel Denied-by-filter:badtraffic src=84.93.238.228 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=24180 DF PROTO=TCP SPT=14300 DPT=6176 WINDOW=115 RES=0x00 ACK PSH URGP=0
16:08:16 kernel Denied-by-filter:badtraffic src=84.93.238.228 DST=my.ip.ad.rs LEN=76 TOS=0x00 PREC=0x00 TTL=51 ID=24181 DF PROTO=TCP SPT=14300 DPT=6176 WINDOW=115 RES=0x00 ACK PSH URGP=0

Has there been any thoughts from PlusNet?

Message 42 of 46
(1,390 Views)
0 Thanks
bobpullen
Community Gaffer
Community Gaffer
Posts: 16,887
Thanks: 4,979
Fixes: 316
Registered: ‎04-04-2007

Re: IMAP 14300

‎05-07-2016 9:43 PM - edited ‎05-07-2016 10:41 PM

Apologies, somewhat lost sight of this one. I'll see what more digging I can do but it's pretty low down on my list of priorities at the mo Undecided

Edit: Had a quick glance at the Wireshark capture @Anonymous sent across a while back and I'm none the wiser. One tip for Wireshark is to right click a packet > follow > TCP stream. That will open another window showing the contents of the conversation and filter the background view accordingly. If you do this with any of the 'bad' packets (those in black), you can easily see that they're not in response to any client activity, although the contents look like they should be Huh

* 3 EXISTS
* 0 RECENT
* 2 FETCH (FLAGS (\Seen))
* BYE Disconnected for inactivity.  

 

Bob Pullen
Plusnet Product Team
If I've been helpful then please give thanks ⤵
Message 43 of 46
(1,372 Views)
0 Thanks
Kelly
Hero
Posts: 5,497
Thanks: 380
Fixes: 9
Registered: ‎04-04-2007

Re: IMAP 14300

‎18-08-2017 5:37 PM

This thread popped up in convos today.  Necroing so we take another look at it in case it's relevant to the ongoing webmail work.

Kelly Dorset
Ex-Broadband Service Manager
Message 44 of 46
(1,225 Views)
0 Thanks
MisterW
Superuser
Superuser
Posts: 14,718
Thanks: 5,503
Fixes: 393
Registered: ‎30-07-2007

Re: IMAP 14300

‎18-08-2017 5:47 PM

@Kelly you're probably aware from my other thread that I've also seen this problem. If you need any firewall logs or any tests undertaken then don't hesitate to give me a shout. I'm happy to help.

Superusers are not staff, but they do have a direct line of communication into the business in order to raise issues, concerns and feedback from the community.

Message 45 of 46
(1,219 Views)