On Friday, June 24, 2005, at 09:32 AM, Claude V. Lucas wrote:
The pattern consists of packets transmitted from the system on a
incrementing high-numbered port with a broadcast destination of
255.255.255.255:2222. Port 2222 is listed by IANA as being assigned to
"rockwell-csp2". A quick Internet search provided little information
on the
intended usage of this port. More interesting was the discovery that
the
appearance of this particular pattern apparently coincides with the
launching of any of the programs included in the Microsoft Office X
suite of
applications. Excel, Word, Power Point, and Entourage all seem to
attempt to
broadcast a few packets at startup, and again at random intervals
while the
program(s) are running. MS Virtual PC also attempts a broadcast, but
to the
same destination port as the source port rather than to port 2222. I
captured a sampling of this behavior with the network traffic analyzer
"ethereal" but I was unable to decode the contents of the transmitted
packets. On program exit Word issues a message "Word is attempting to
connect to the printer".
Yes, that's the message I get. Apparently horsepuckey. Thanks a lot
for this info! It will take some study to know what's going on her and
what to do about it as I'm on the bottom end of the learning curve.
The timing of this message coincides with a log
entry as described earlier. This phenomenon turns out to be an
anti-piracy
scheme that checks for duplicate registration numbers on the local
subnet.
If there is, both copies will shut down and send a nastygram to the
respective screens.
http://www.ciac.org/ciac/techbull/CIACTech02-003.shtml
further explains this activity
Serious work here. Thanks.
I block all outbound broadcast traffic to that port without any ill
effect
on the operation of Office. I've done this with both "X" and "2004"
without
impairing the function of Office that I can see. No printing problems
are
noted on my system as a result of dropping this traffic.
Claude
Good detective work!
- Peter Schaff
PM: 1GHz DP/1 GB/80GBx2/10.2.8
iMac: 600MHz/768MB/40GB/10.2.8
PB: 3400C/9.1
Brother HL-1870N laser, Epson 785EPX, Epson 2450 scanner
_______________________________________________
Littlesnitch-talk mailing list
[email protected]
http://at.obdev.at/mailman/listinfo/littlesnitch-talk
