Re: TCP port 7 traffic from DoubleClick

[Vern Paxson <vern () ee lbl gov>]

> Speaking of which, I saw these in my outbound logs a few days back:
>
> my.host.com -> stats.hitbox.com:12343
>
> I haven't tracked down the specific source yet, but it's probably either a URL
> or a JavaScript that is logging hit-counts for a page. The question is, as
> always, what else is it logging? :-)

Here's a day's worth of those from our DMZ:

/Hitbox?hb=W71901240719&cd=4&ts=30504&hr=12&jv=1.1.5&jm=Netscapew102.hitbox.com
/Hitbox?hb=W38903304657&cd=4&ts=8790&hr=21&jv=1.1.5&jm=Netscapew118.hitbox.com
/Hitbox?hb=CAD904037004&cd=4&ts=96730&hr=21&jv=1.1.5&jm=Netscapew105.hitbox.com
/Hitbox?hb=TTN812023443&cd=4&ts=9940&hr=17&jv=1.1.5&jm=Netscapew114.hitbox.com
/Hitbox?hb=W95903249709&cd=4&ts=18510&hr=16&jv=1.1.5&jm=Netscapew115.hitbox.com

in five connections.

So at least this sample looks fairly innocuous.

                Vern