RE: Who is my i5 trying to connect to, and why?

Message . . . . : TCP/IP connection to remote system 70.145.58.103 closed,
reason code 1.
Cause . . . . . : The TCP/IP connection to remote system 70.145.58.103 has
been closed. The connection was closed for reason code 1. Full connection
details for the closed connection include:
- local IP address is 192.168.1.16
- local port is 80
- remote IP address is 70.145.58.103
- remote port is 50639

Aha...

Well, it appears it's no big deal, then. Just hackers trying to get into my
system and failing.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx]On Behalf Of Bryan Dietz
Sent: Sunday, December 23, 2007 8:47 AM
To: Midrange Systems Technical Discussion
Subject: Re: Who is my i5 trying to connect to, and why?


Brad, Put your cursor on one of messages and press F-1. In there you
will see port information.

Most likely they will be headed to port 80. I you see other ports in
the help I would investigate what you have opened up to the system.

I like to you IPNetInfo:
http://www.nirsoft.net/utils/ipnetinfo.html
to help figure out where the IP addresses are from.

Happy Hunting,
Bryan


Bradley V. Stone said the following on 12/23/2007 9:00 AM:

I was checking out the QSYSOPR messages today and noticed a few

of these:

TCP/IP connection to remote system 192.168.1.1 closed, reason code 1.
TCP/IP connection to remote system 89.122.213.8 closed, reason code 2.
TCP/IP connection to remote system 89.122.213.8 closed, reason code 2.
TCP/IP connection to remote system 72.166.155.41 closed, reason code 2.
TCP/IP connection to remote system 72.166.155.41 closed, reason code 2.
TCP/IP connection to remote system 72.166.155.41 closed, reason code 2.
TCP/IP connection to remote system 67.82.120.36 closed, reason code 2.
TCP/IP connection to remote system 70.145.58.103 closed, reason code 1.

Now, I'm pretty sure I don't have anything that would go out to

connect to a

remote system (like GETURI). I do have apache running my web page.

The funny thing is, the first one in the list is my router.

The other ones,

I have no idea who they are. I looked them up in DNSStuff but nothing
"clicked".

Any ideas?

Brad

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)
mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.