Re: Munged Napster Sessions

[simond () IRRELEVANT ORG (simond () IRRELEVANT ORG)]

On Fri, Mar 17, 2000 at 05:19:22AM +0700, Vanja Hrustic wrote:
> "Stephen P. Berry" wrote:
> > Notably, the traffic of interest includes various bogus TCP flag
> > combinations (everything from SYN-FIN packets to full Xmas packets),
> > bogus TCP flags, and tiny fragments.
> >
> > In absence of the established napster session, the anomalous traffic would
> > look powerfully like some sort of TCP fingerprinting attempt to
> > me.
>
> A silly question: is any of sites involved located at *.demon.co.uk, by
> any chance?
>
> I think that quite many people these days are seeing false alarms caused
> by traffic which comes from demon. Demon blames it on "network
> equipment". For example, a guy (using demon.co.uk) is browsing my
> website, and during that session, a packet is sent to random high port
> (like 3xxxx). Packets are really strange; sometimes they have all bits
> set, sometimes not.
>
> I just got used to that :)

As far as I know they fixed that last year, it was due to some problem
with their Ascend GRF's, I may be wrong though :)

--
Simon Dick                                      simond () irrelevant org