popularity-contest

[Tony Arnold]

R Kimber wrote:
> On Wed, 28 Mar 2007 16:36:49 +0200
> Carsten Aulbert wrote:
> 
>> When you install this package, it sets up a cron job that will
>> anonymously submit statistics about your most used packages
>> periodically to the developers.
>>
>>  This information helps us make decisions such as which packages
>> should be promoted and so be in standard installs.
> 
> Is this anything to do with it? 91.189.89.6 seems to be Canonical
>  
> Mar 17 07:35:01 kernel: [1290021.155726] Inbound IN=eth0 OUT=
> MAC=<....> SRC=91.189.89.6 DST=192.168.1.100 LEN=44 TOS=0x00 PREC=0x80
> TTL=60 ID=51062 DF PROTO=TCP SPT=80 DPT=36015 WINDOW=64240 RES=0x00 ACK
> SYN URGP=0

This is part of the three way handshake used by TCP to set up a
connection. It's a response to the outgoing SYN packet from your machine
to Canonical's address on port 80. Given the time of day, I suspect this
is part of the check for updates.

Why your firewall is flagging such packets, I've no idea. Firewall rules
should allow replies to outgoing packets, usually using the
'established' flag.

Regards,
Tony.
-- 
Tony Arnold, IT Security Coordinator, University of Manchester,
IT Services Division, Kilburn Building, Oxford Road, Manchester M13 9PL.
T: +44 (0)161 275 6093, F: +44 (0)870 136 1004, M: +44 (0)773 330 0039
E: tony.arnold at manchester.ac.uk, H: http://www.man.ac.uk/Tony.Arnold