Canonical network activity
tony.arnold at manchester.ac.uk
Sat Mar 3 13:22:26 UTC 2007
R Kimber wrote:
> Mar 3 07:35:02 infinity kernel: [738616.529708] Inbound IN=eth0 OUT=
> MAC=xxxxxxx SRC=220.127.116.11 DST=192.168.1.100 LEN=44 TOS=0x00 PREC=0x80
> TTL=60 ID=4045 DF PROTO=TCP SPT=80 DPT=34813 WINDOW=64240 RES=0x00 ACK
This looks like a SYN-ACK packet which is sent in response to a SYN
packet sent from you machine to Canonical. It's part of the initial
three way handshake used to set up a connection. So this is your machine
trying to connect to a Canonical address over port 80 (http). I suspect
it is Ubuntu doing daily updates or something.
Why logcheck is picking this up, I have no idea.
Tony Arnold, IT Security Coordinator, University of Manchester,
IT Services Division, Kilburn Building, Oxford Road, Manchester M13 9PL.
T: +44 (0)161 275 6093, F: +44 (0)870 136 1004, M: +44 (0)773 330 0039
E: tony.arnold at manchester.ac.uk, H: http://www.man.ac.uk/Tony.Arnold
More information about the ubuntu-users