Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 2 subscribers
  • Views 279 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DNS Packets Seen as MSN IM

NUB-N
I just noticed in the daily reports that Astaro was picking up MSN IM traffic and had been for some time.  Strange because this is not an activity that we do normally.  This is an example of what's in the IM/P2P Classifier log:

----

2008:06:18-00:32:22 (none) ulogd[2636]: id="2019" severity="info" sys="SecureNet" sub="packetfilter" name="AFC Block" action="drop" fwrule="60101" outitf="eth1" srcip="untrusted interface IP" dstip="68.237.161.12" proto="17" length="80" tos="0x00" prec="0x00" ttl="64" srcport="32769" dstport="53" 

----

If I'm not mistaken, this is really UDP 53 DNS traffic. My reports indicate that this behavior started with 7.2 and continues with 7.201.

Any ideas????[:S]

NUB-N


This thread was automatically locked due to age.