cancel
Showing results for 
Search instead for 
Did you mean: 

Strange incoming probes from PlusNet addresses (Mail servers perhaps ??)

Community Veteran
Posts: 6,419
Thanks: 531
Fixes: 48
Registered: 30-07-2007

Strange incoming probes from PlusNet addresses (Mail servers perhaps ??)

Not really sure this is the right forum for this but let's put it here for starters...

 

I've just had cause to look at our office Firewall log ( for a completely different reason) and noticed there are bursts of incoming TCP packets from various addresses in the 84.83.229 & 84.93.238 subnets. These lookup as mailc<nn>.plus.net (are they the Cloudmark servers by any chance ?)

For information,  the office connection is NOT a PlusNet one ( it's Zen ) and it's not running a mail server.

Would someone ( @bobpullen perhaps ? ) care to explain where these incoming requests are coming from and why ?

I can PM an extract from the firewall log if it's useful

 

 

 

5 REPLIES
Community Gaffer
Community Gaffer
Posts: 13,152
Thanks: 926
Fixes: 77
Registered: 04-04-2007

Re: Strange incoming probes from PlusNet addresses (Mail servers perhaps ??)

They're the mail collection servers. So it's likely in response to something on the network polling mail.plus.net or imap.plus.net.

Bob Pullen
Plusnet Product Team
If I've been helpful then please give thanks ⤵

Community Veteran
Posts: 6,419
Thanks: 531
Fixes: 48
Registered: 30-07-2007

Re: Strange incoming probes from PlusNet addresses (Mail servers perhaps ??)

Thanks for the reply Bob. Yes, my phone would have been on the network polling the imap server for my PlusNet account, but surely that would be a solicited response and therefore be allowed through the firewall via an open NAT session ?

These seem to be unsolicted requests and are being blocked by the Firewall.

edit: I wonder if it's timing out on a reply from the imap server and the NAT pinhole is closed before the reply comes back ?

Community Gaffer
Community Gaffer
Posts: 13,152
Thanks: 926
Fixes: 77
Registered: 04-04-2007

Re: Strange incoming probes from PlusNet addresses (Mail servers perhaps ??)

There's an old thread knocking about where this was discussed. On mobile at the mo so will have a search for it when it's more convenient.
Don't think it ever came to a worthwhile conclusion, but it was a valid question at the time.

Bob Pullen
Plusnet Product Team
If I've been helpful then please give thanks ⤵

Community Veteran
Posts: 6,419
Thanks: 531
Fixes: 48
Registered: 30-07-2007

Re: Strange incoming probes from PlusNet addresses (Mail servers perhaps ??)

Thanks Bob. No great rush, I'm working from home tomorrow , so won't be back in the office till Monday.

Community Veteran
Posts: 6,419
Thanks: 531
Fixes: 48
Registered: 30-07-2007

Re: Strange incoming probes from PlusNet addresses (Mail servers perhaps ??)

@bobpullen I think this https://community.plus.net/t5/Email/IMAP-14300/td-p/1339262 is the old thread you were referring to.

Yup, looks like it's exactly the same issue that I am seeing , ACK's on port 14300 from the mail servers.hwall

As the OP in that thread @Simon we use Smoothwall as well.

Might be better if we return to  that old thread and leave this one...