Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: lots of connections to port 80
From: mcwidget <mcwidget () gmail com>
Date: Fri, 18 Apr 2008 18:20:18 +0100

     I would assume the first sentence means you are seeing outgoing
connections, from your client's site, destined for the IP/port above.  So
then, the second sentence makes even less sense, connections coming into
your network from all over the Internet, but 'specifically to this IP'?
Huh?  Maybe I just need more coffee, but please explain this one for me.

I think what he's saying is that the IP address listed belongs to one of his
clients and they are receiving connections to port 80 on that IP from all
over the internet; and asking why this would be happening.

The obvious answer is because a process running on that IP is listening on
that port.  Really, any more detailed description than that, even confirming
it's serving a website, is gonna require some packet grabs or info on the
process listening on that port.  Or both.
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]