cancel
Showing results for 
Search instead for 
Did you mean: 

Strange incoming probes from PlusNet addresses (Mail servers perhaps ??)

MisterW
Superuser
Superuser
Posts: 11,163
Thanks: 3,438
Fixes: 260
Registered: ‎30-07-2007

Strange incoming probes from PlusNet addresses (Mail servers perhaps ??)

Not really sure this is the right forum for this but let's put it here for starters...

 

I've just had cause to look at our office Firewall log ( for a completely different reason) and noticed there are bursts of incoming TCP packets from various addresses in the 84.83.229 & 84.93.238 subnets. These lookup as mailc<nn>.plus.net (are they the Cloudmark servers by any chance ?)

For information,  the office connection is NOT a PlusNet one ( it's Zen ) and it's not running a mail server.

Would someone ( @bobpullen perhaps ? ) care to explain where these incoming requests are coming from and why ?

I can PM an extract from the firewall log if it's useful

 

 

 

Superusers are not staff, but they do have a direct line of communication into the business in order to raise issues, concerns and feedback from the community.

5 REPLIES 5
bobpullen
Community Gaffer
Community Gaffer
Posts: 16,049
Thanks: 3,813
Fixes: 242
Registered: ‎04-04-2007

Re: Strange incoming probes from PlusNet addresses (Mail servers perhaps ??)

They're the mail collection servers. So it's likely in response to something on the network polling mail.plus.net or imap.plus.net.

Bob Pullen
Plusnet Product Team
If I've been helpful then please give thanks ⤵

MisterW
Superuser
Superuser
Posts: 11,163
Thanks: 3,438
Fixes: 260
Registered: ‎30-07-2007

Re: Strange incoming probes from PlusNet addresses (Mail servers perhaps ??)

Thanks for the reply Bob. Yes, my phone would have been on the network polling the imap server for my PlusNet account, but surely that would be a solicited response and therefore be allowed through the firewall via an open NAT session ?

These seem to be unsolicted requests and are being blocked by the Firewall.

edit: I wonder if it's timing out on a reply from the imap server and the NAT pinhole is closed before the reply comes back ?

Superusers are not staff, but they do have a direct line of communication into the business in order to raise issues, concerns and feedback from the community.

bobpullen
Community Gaffer
Community Gaffer
Posts: 16,049
Thanks: 3,813
Fixes: 242
Registered: ‎04-04-2007

Re: Strange incoming probes from PlusNet addresses (Mail servers perhaps ??)

There's an old thread knocking about where this was discussed. On mobile at the mo so will have a search for it when it's more convenient.
Don't think it ever came to a worthwhile conclusion, but it was a valid question at the time.

Bob Pullen
Plusnet Product Team
If I've been helpful then please give thanks ⤵

MisterW
Superuser
Superuser
Posts: 11,163
Thanks: 3,438
Fixes: 260
Registered: ‎30-07-2007

Re: Strange incoming probes from PlusNet addresses (Mail servers perhaps ??)

Thanks Bob. No great rush, I'm working from home tomorrow , so won't be back in the office till Monday.

Superusers are not staff, but they do have a direct line of communication into the business in order to raise issues, concerns and feedback from the community.

MisterW
Superuser
Superuser
Posts: 11,163
Thanks: 3,438
Fixes: 260
Registered: ‎30-07-2007

Re: Strange incoming probes from PlusNet addresses (Mail servers perhaps ??)

@bobpullen I think this https://community.plus.net/t5/Email/IMAP-14300/td-p/1339262 is the old thread you were referring to.

Yup, looks like it's exactly the same issue that I am seeing , ACK's on port 14300 from the mail servers.hwall

As the OP in that thread @Simon we use Smoothwall as well.

Might be better if we return to  that old thread and leave this one...

Superusers are not staff, but they do have a direct line of communication into the business in order to raise issues, concerns and feedback from the community.