Canonical network activity

Tony Arnold tony.arnold at
Sat Mar 3 13:22:26 UTC 2007


R Kimber wrote:

> Mar  3 07:35:02 infinity kernel: [738616.529708] Inbound IN=eth0 OUT=
> MAC=xxxxxxx SRC= DST= LEN=44 TOS=0x00 PREC=0x80
> TTL=60 ID=4045 DF PROTO=TCP SPT=80 DPT=34813 WINDOW=64240 RES=0x00 ACK
> SYN 

This looks like a SYN-ACK packet which is sent in response to a SYN
packet sent from you machine to Canonical. It's part of the initial
three way handshake used to set up a connection. So this is your machine
trying to connect to a Canonical address over port 80 (http). I suspect
it is Ubuntu doing daily updates or something.

Why logcheck is picking this up, I have no idea.

Tony Arnold, IT Security Coordinator, University of Manchester,
IT Services Division, Kilburn Building, Oxford Road, Manchester M13 9PL.
T: +44 (0)161 275 6093, F: +44 (0)870 136 1004, M: +44 (0)773 330 0039
E: tony.arnold at, H:

More information about the ubuntu-users mailing list