Canonical network activity

[Tony Arnold]

Richard,

R Kimber wrote:

> Mar  3 07:35:02 infinity kernel: [738616.529708] Inbound IN=eth0 OUT=
> MAC=xxxxxxx SRC=91.189.89.8 DST=192.168.1.100 LEN=44 TOS=0x00 PREC=0x80
> TTL=60 ID=4045 DF PROTO=TCP SPT=80 DPT=34813 WINDOW=64240 RES=0x00 ACK
> SYN 

This looks like a SYN-ACK packet which is sent in response to a SYN
packet sent from you machine to Canonical. It's part of the initial
three way handshake used to set up a connection. So this is your machine
trying to connect to a Canonical address over port 80 (http). I suspect
it is Ubuntu doing daily updates or something.

Why logcheck is picking this up, I have no idea.

Regards,
Tony.
-- 
Tony Arnold, IT Security Coordinator, University of Manchester,
IT Services Division, Kilburn Building, Oxford Road, Manchester M13 9PL.
T: +44 (0)161 275 6093, F: +44 (0)870 136 1004, M: +44 (0)773 330 0039
E: tony.arnold at manchester.ac.uk, H: http://www.man.ac.uk/Tony.Arnold