Re: How to determine incoming, good or bad?



Why - are you running a web _server_ on a dialin?
Web server? Sorry, but I don't see where I said that I was running a web
server. At 26k that would probably give the world less than stellar
access. No web server. Just a Smoothwall in firewall mode only.

Then you probably don't want any ports open on the Internet side of
things. Try 'netstat -antup' and verify that nothing is happening.

Ah so. Something like netstat is what I was looking for. Now waiting
for the access to start again to see what happens.

I save my heavy surfing for my machine at work.

That gets you fired here, but what-ever.
Nope. Perfectly ok here. Special deal.

last for a minute or so.

and where are you getting these messages?
In the browser (firefox) bottom bar. Looking up Google.com. Waiting for
Google.com. Timeout or server reset popup some times if it gets real bad.

In other words, even slower than my usual half speed dialup, if you can
imagine such.

Some of us go back to the age of 1200 BPS modems in PCs - some even
further to acoustic couplers. Sounds as if you are running a browser as
a do-all client, rather than using individual tools.

At least you didn't ask me why I don't switch to broadband - everybody
else does. I would pay a premium for broadband. I would pay for the
cable or fiber to be laid to my house. I would sign over my controlling
interest as a citizen in Fort Knox for broadband. Alas, reports have it
that it is not scheduled for my area until 2024. (Early spring, they tell
me)

No, just running Firefox as a browser and not much of that - too slow.

I go back to what IBM used to call 75 baud start-stop in the 60's. An
early term for what would become known as asychronous communications. I
have stuffed a phone in a few rubber lip pairs.


'netstat -antup' will identify the processes that are talking

About every 5 minutes it will start up again.

What applications are you using? What cron jobs do you have?

No apps running except what cranks up with Debian. Don't see anything in
ps -A that I don't recognise. No cron jobs. This is just a machine that
I program on. Mostly perl.

This was my first thought - what have I loaded that is trying to phone
home? The answer is nothing new has been loaded besides perl-TK and
Debian security updates for a couple of years. Besides, I cranked up
another machine that is raw - that is, nothing but a primary Debian load -
that I use for learning and it got the same incoming stuff.

I have no auto updates on either Firefox or Thunderbird, besides they
would tell me if they had just updated.

There usually is over a hundred applications running at a time (try
using 'ps afuw' to see what they are) besides your browser.

Again, I see nothing unusual running. Notice that I said that I see
nothing, not that nothing unusual might be running. Still looking.

Something is being sent to me on regular intervals and I need to find
out what. Even if it is not something bad, it totally hoses what little
bandwidth I have.

We have no idea what all you are running on your system, but the place
to start is netstat and see what all is talking - do this during the
time when the RD light is on. See the man page for details.

Ok. Man page on netstat is up and being purused. I think I remember that
utility from years past, but long since forgot about it.

Thanks for the tip.
Killi


.

Relevant Pages

  • [NT] Poisoning Cached HTTPS Documents in Internet Explorer
    ... Get your security news from a reliable source. ... "poison" a user's browser cache with a malicious document that will later ... The attacker can exploit this vulnerability for "replacing" HTML ... to communicate with a malicious web server over HTTPS without the browser ...
    (Securiteam)
  • RE: [Full-Disclosure] How big is the danger of IE?
    ... The following link details compromised/malicious web servers infecting ... the web server configuration to append the script to all files served by ... method used to compromise the servers. ... switching to another browser may significantly reduce ...
    (Full-Disclosure)
  • RE: [Full-Disclosure] How big is the danger of IE?
    ... The following link details compromised/malicious web servers infecting ... the web server configuration to append the script to all files served by ... method used to compromise the servers. ... switching to another browser may significantly reduce ...
    (Full-Disclosure)
  • Re: ampersand in urls when using xhtml 1.0 strict
    ... My web server is clearly seeing & and the browser is ... After including this header I was able to remove the encoded ... First, this is very strange because if your browser was displaying the page as HTML, then it was already receiving a content type header from the web server telling it that the page was HTML, or else there was no header and the browser was treating it as HTML by default. ...
    (comp.infosystems.www.authoring.html)
  • Re: Control referring domain, another HTTP_REFERER option?
    ... If you trust the user's browser, ... so they could share a database, the referring web server could leave ... Cookies are designed not to work that way. ...
    (comp.lang.php)