hubcap@gatech.UUCP (11/19/87)
I wonder what's going on here?
I am not sure how long this has been going on, but I have noticed the
following connection between my machine and utah-arpa-gw.arpa for the
last few days: (edited output of "netstat -a" follows...)
----------------------------------------------------------------------------
Active connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
.
.
.
tcp 0 0 hubcap.clemson.e.2462 utah-arpa-gw.arp.telne FIN_WAIT_2
.
.
.
----------------------------------------------------------------------------
Note: sometimes the state is "ESTABLISHED", other times, FIN_WAIT_2...
I was curious at first when I saw it, but there's lots of users here, and
its none of my business where they telnet to... then I noticed that this
connection was still present immediately after a reboot.
So, to make a long story short, this connection has been here constantly
for at least a week (probably longer).
Does anyone want to hazard a guess as to what the deal might be?
thanks...
Mike Marshall hubcap@hubcap.clemson.edu ...!hubcap!hubcapcetron@CS.UTAH.EDU.UUCP (11/20/87)
I just check out cisco box (utah-arpa-gw) and it had two idle incoming sessions from hubcap.clemson.edu showing idle for 3 days+ and originating at hubcap. It appears like somebody is telnetting to our gateway, and then into some other machine.... This may be because with the egp/ggp problems, the can't reach the 128.110.xx.xx addresses any other way. Given the load on our cisco, and assuming there is a legitimate user at clemson trying to telnet into our 128.110 net, I would think that a static route (oh how horrible :-) ) would be better then tying up band- width in the gateway. Any comments from the net at large? -ed cetron cetron@cs.utah.edu