Mysterious sudden firewall hits

[deftech]

Wingate firewall hit report:

Time: 4/13/2006 10:31:08 AM
Reason: Port Range
Source MAC address: 00-90-69-C7-5C-BC
Destination MAC address: 00-10-4B-28-07-CB
Source IP Address: 70.84.252.67 : 995
Destination IP Address: 64.128.84.6 : 4131
Protocol: TCP
TCP flags: R
Time-to-live: 55

The "source" is my mail server. The destination is wingate. Port 995 is pop3 ssl, and is how I check pop3. I don't get why these all of a sudden started showing in my logs. Everything is working fine, just wondering why they are showing up. Nothing has changed in either configuration on either wingate or my mail server.

Any ideas?

[adrien]

Hi

The key here is the TCP flags field - it's a reset packet. Looks like the connection closed, which means that WinGate closed the open firewall hole for that connection. Some time afterwards, the other end of the connection (your mail server) sent a reset to close the connection, or possibly to complete its understanding of closing the connection.

I would ignore these.

Regards

Adrien

[deftech]

ignoring!

You guys rock, I love wingate! I want to be buried with a copy of wingate, and a picture of scarlett johansen.

THanks Adrien!

[Pascal]

I want to be buried with a copy of wingate, and a picture of scarlett johansen

That has to be the quote of the day :)

[genie]

:))))))))))) I am going to seek your permission to publish this quote on our Web site!

[Nev]

:))))))))))) I am going to seek your permission to publish this quote on our Web site!

:-))

[deftech]

hehe, go for it!