[aclug-L] Re: Hacker or ??

[Steven Saner <ssaner@xxxxxxxxxxxxxxx>]

You are likely to receive a SYN packet (basically just a mostly empty
TCP packet that is asking to make a connection) for any real IP
address that is on your network. If there is no machine with that IP
address, then there will of course be no response, other than maybe an
ICMP host unreachable from your router. If there is a machine with
that IP address, but there is nothing listening to port 80, there will
be a response basically saying that the port is not open. If you have
private addresses behind the NAT box, there won't be a connection
attempt to those directly.

Steve


On Tue, Sep 18, 2001 at 04:40:31PM -0500, gLaNDix (Jesse Kaufman) wrote:
> 
> On 18 Sep 2001 16:28:37 -0500, Steven Saner wrote:
> > Well, mostly. You will still get the TCP SYN packet on all of your IP
> > addresses, but if there is no web server listening, there won't be a
> > response and there will never be a HTTP GET request and 404
> > response, which are both bigger packets.
> 
> so even with my wkstation being "NAT-ed" and behind a firewall (both NAT
> & firwall are on the same machine), it will still get the SYN packet?
> 
> (sorry if that's a dumb question, but we haven't gotten that far in
> NetTech yet! : ^ )
> 
> thx,
> gLaNDix
> 
> -- This is the discussion@xxxxxxxxx list.  To unsubscribe,
> visit http://tmp2.complete.org/cgi-bin/listargate-aclug.cgi
-- This is the discussion@xxxxxxxxx list.  To unsubscribe,
visit http://tmp2.complete.org/cgi-bin/listargate-aclug.cgi