Re: lots of connections to 64.40.117.19 port 80

[mcwidget <mcwidget () gmail com>]

>      I would assume the first sentence means you are seeing outgoing
> connections, from your client's site, destined for the IP/port above.  So
> then, the second sentence makes even less sense, connections coming into
> your network from all over the Internet, but 'specifically to this IP'?
> Huh?  Maybe I just need more coffee, but please explain this one for me.

I think what he's saying is that the IP address listed belongs to one of his
clients and they are receiving connections to port 80 on that IP from all
over the internet; and asking why this would be happening.

The obvious answer is because a process running on that IP is listening on
that port.  Really, any more detailed description than that, even confirming
it's serving a website, is gonna require some packet grabs or info on the
process listening on that port.  Or both.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/