Re: TCP port 7 traffic from DoubleClick

["C. Harald Koch" <chk () pobox com>]

In message <990601185533.SAA21008 () gateway mikon com>, Greg Nowicki writes:
> My firewall has been logging a persistent stream of TCP connection attempts
> to port 7 (echo) from six hosts belonging to DoubleClick.  I would like to
> know if anyone else on the list has observed this?

Here's a message discussing the issue, rumoured to be from the source:

-- 
Harald Koch <chk () pobox com>
> --- Begin Message ---
>
>
> From: "Raymond D. Mereniuk" <Raymond () fbn bc ca>
>
> Date: Thu, 10 Jun 1999 07:52:24 -0800
>
> Followed up on this and received the following response this 
> morning from the folks responsible.
>
> ------------------------------------------------------------------------------
> Dear Sir,
>         
>         We are currently using the product GlobalDispatch from Resonate Inc.
> for our Wide Area  Data Distribution.  Please see letter below for a detail explaination on
> this product.  Thanks.
>
> Sincerely,
>
> Alex Ng
> Doubleclick
> --------------------
>
> Hello Sir,
>  
> Alex at Doubleclick asked us to work with you regarding this ticket.
>  
> We have reason to believe that the reports you've received regarding
> these three machines being compromised is a misunderstanding as a result
> of our enterprise traffic management software: Global Dispatch.  Global
> Dispatch is a WAN-based scheduler that makes it easy to place content
> close to geographically dispersed users and and intelligently directs
> requests to the best-suited Point of Presence (POP). 
>  
> In the course of determining the best suited POP, Global Dispatch preforms a
> latency measurement.  This latency measurement is done by making a
> connection  to the client DNS server on TCP port 7 and then dropping the connection.
> After the latency measurement has been done, the latency values are cached, and
> the IP of the most responsive POP is returned to the requesting machine.
>  
> I hope this help clear up the confusion. We are looking into other ways to
> preform this latency mesurment, and hope we have not caused you any
> inconvenience.
>  
> --
> Resonate Technical Support <support () resonate com>
>         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>         Richard Day     Call Center Manager
>
>         Resonate, Inc.
>         465 Fairchild Drive 
>         Suite 115
>         Mountain View, CA 94040
>
>         Main Phone   650 967.6500
>         Fax          650 967.6561
>         Support Line 650 967.4800
>         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>
>
>
>
>
> Virtually
>
>
> Raymond D. Mereniuk
> Raymond () fbn bc ca
> "The Ultimate Enterprise Security Experts" 
> http://www.fbn.bc.ca/sysecurt.html
>
>
> --- End Message ---