Re: Unauthorized outgoing connect caught by ZA

[Leonardo Serni <sernil () TIN IT>]

At 10.08 15/10/00 -0400, j nickson <jnickson () TOGETHER NET> wrote:
> Case History:  Unauthorized request from workstation to connect to Akamai.
>
> I saw some unusual activity so I stopped *all* net programs  and put Zone
> Alarm (2.1.25) into LOCK.
>
> A few *minutes* later I was rewarded with:
>
> --------------------------
> The firewall has blocked Internet access to a388.g.akamai.net
> (63.160.183.233) (HTTP) from your computer.

Pardon me, but could it be that a (mostly) legitimate connection was severed
and the OS itself took charge of closing the sockets (after a suitable time)
so that Z.A. did actually intercept either a "dead connection" or a "anybody
home?" packet?

Something of the kind happens to me all the time when surfing over *sloooow*
web sites. Which are the majority, when seen from an Italian ISP line :-).

The traffic goes down, the Linux box drops the connection. After seconds, or
perhaps minutes, something on the Windows box awakens and sends out packets,
which are dropped.

Leonardo