Just a guess, but I think the pm1-17 entry is the Lucent PortMaster he
dialed into. I show the same type of entries in my logs and I know my
ISP uses them.
"David A. Ranch" wrote:
>
> >The download then fails after about 90 sec.
>
> Are you setting any timeouts in your rc.firewall ruleset? If not,
> try doing that first. Its described in TrinityOS - Section 10.
>
> >Why in the second dump does the far end send packets to my windows machine
> >(192.168.1.101), shouldn't that be behind the ipmasq?
>
> First, in your tcpdump,
>
> 1. onlpatch.quicken.com.http - This must be Intuit's update server
> 2. supermega.little.net.3516 - What is this server?
> Is this your 192.168.1.101 server?
> 3. pm1-17.ro.com.64583 - This must be your Linux box
>
> What is #2??? The reason being:
>
> --
> 23:27:48.751953 onlpatch.quicken.com.http > supermega.little.net.3516: .
> 141:1601(1460) ack 471 win 61320 (DF)
> 23:27:48.914063 pm1-17.ro.com.64583 > onlpatch.quicken.com.http: . ack 1601 win
> 8760 (DF)
> --
>
> Thats an odd traffic flow.
>
> --David
> .----------------------------------------------------------------------------.
> | David A. Ranch - Linux/Networking/PC hardware [EMAIL PROTECTED] |
> !---- ----!
> `----- For more detailed info, see http://www.ecst.csuchico.edu/~dranch -----'
>
> _______________________________________________
> Masq maillist - [EMAIL PROTECTED]
> http://tiffany.indyramp.com/mailman/listinfo/masq
> Admin requests can be handled by web (above) or [EMAIL PROTECTED]
--
Edison Information Technologies
P.O. Box 554
Milan, OH 44846-0554
419.499.7040
[EMAIL PROTECTED]
--
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
http://tiffany.indyramp.com/mailman/listinfo/masq
Admin requests can be handled by web (above) or [EMAIL PROTECTED]
