On 19 Aug 2004 16:57:35 -0700, [EMAIL PROTECTED] (A) wrote:
>Leaving that issue to one side for a moment, the hits from external >hosts with source port of 80, are they just from left over web traffic? Usually, quickest way to test would be to do a reverse lookup of the source IPs and see where they are coming from. >Or are there some cunning scanners that are tailing in on a "keep >state"? I am thinking not as I have looked at how the state table is >checked and it would be hard to trick it. It sounds like you have a timeout mismatch in your firewall sandwich. greg -- Es ist mein Teil - nein Mein Teil - nein Denn das ist mein Teil - nein Mein Teil - nein
