Re: [Somewhat OT] - Why would a web server ping me?

[Erek Adams <erek () snort org>]

On Mon, 10 Mar 2003, Bob McDowell wrote:

[...snip...]

> What's tying me up is the icmp.  Why would a non-user ping me?  Or, in other
> words, why would an automated process running on a web server ping one of
> its clients?
>
> Has anyone seen this before?  Is this normal?

Yep.  Used quite often by load balencers of some types or something like
Speedera, or even Keynote.  They traceroute and/or ping you to find the
quickest response times, and then send the data from that location.  Check
the 'real' location of the site in question...  I'd bet it's setup for
'global load balenceing' or something of the sort.

> Or is this site up to something nefarious?

What site _isn't_?  If they were, we wouldn't have a job now would we?
;-)

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


-------------------------------------------------------
This SF.net email is sponsored by:Crypto Challenge is now open! 
Get cracking and register here for some mind boggling fun and 
the chance of winning an Apple iPod:
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0031en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users