Date: Thu, 20 Mar 2003 17:53:59 +1100
From: Mick <asurfer@...g.com.au>
To:  popa3d-users@...ts.openwall.com
Subject: Re: popa3d[28669]: Didn't attempt authentication

Hi Michael.

Thanks for responding.

Actually, right after I posted, it occurred to me that I should add a 
rule to iptables and log inbound connection attempts to port 110.

As it turns out, it appears that the log messages the messages are in 
fact generated by the email client from the one person who accesses the 
machine via pop3 because the client seems to spit out one more TCP 
packet with the ACK flag set immediately after it sends the packet with 
the FIN flag set:

PROTO=TCP SPT=2478 DPT=110 WINDOW=16384 RES=0x00 SYN URGP=0

PROTO=TCP SPT=2478 DPT=110 WINDOW=16968 RES=0x00 ACK URGP=0

PROTO=TCP SPT=2478 DPT=110 WINDOW=16963 RES=0x00 ACK PSH URGP=0

PROTO=TCP SPT=2478 DPT=110 WINDOW=16958 RES=0x00 ACK PSH URGP=0

PROTO=TCP SPT=2478 DPT=110 WINDOW=16952 RES=0x00 ACK FIN URGP=0

PROTO=TCP SPT=2478 DPT=110 WINDOW=16952 RES=0x00 ACK URGP=0

Not surprisingly, the client he uses is Microsoft Outlook.

Michael Meyer wrote:

>Mick wrote:
>  
>
>>The subject line appears in /var/log/messages once every 10 minutes on 
>>my Redhat 7.3 based system.
>>    
>>
>
>where is the connection come from? 
>
>  
>
>>At the moment, there is only one user accessing the pop server on that 
>>machine and I can see when he successfully authenticates and retrieves 
>>his email. Other than that, no one else has a pop3 account on that 
>>    
>>
>
>i dont believe that this is a regular pop3-connection. perhaps, any kind of
>misconfigured service in your LAN.
>
>micha
>
>
>  
>

Hosted by DataForce ISP - Powered by Openwall GNU/*/Linux