Re: strange outbound connection

[Tim Hardy <tim@timhardy.net>]

johannes wrote:
> Magnus Pedersen wrote:
>
> > johannes wrote:
> >
> > > The gui of my firewall reports a strange outbound connection on port 
> > > 1054 to a strange IP.
> > >
> > > How could I determine which process matches this connection?
> > > How could I determine if this is something worrying?
> > >
> > > Thanks for any help and links.
> > >
> > > Johannes
> > netstat -plant | grep 1054
> ...shows nothing.
>
> I guess it's a problem of firestarter (firewall gui)???

What exactly is the firewall saying? What IP is the connection being 
made to? I don't know firestarter so I can't really comment on that

Are you running netstat while the firewall is registering activity or 
afterwards? Or is the firewall blocking this connection. netstat will 
only show currently active connections afaik

Try running ethereal too to see if you can capture any packets sent on 
this connection - it might give you a better clue



> Thanks,
> Johannes

--
Tim Hardy
www.timhardy.net/
+44 (0)7739015366