-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Yes, it is safe to ignore them. 193.216.148.226 is a web server. One
(or more) of your internal clients are browsing the site. Sometimes
it takes a while for images to load, however, if the user(s) click on
an URL or exist the web browser, the browser will close all its open
(or pending, from an IP handshake point of view) connections (i.e.
image downloads). That closing of the TCP connection is of course
done with a RST packet. The firewall realizes that the TCP sequence
was correct (SYN, SYN-ACK) but before data was returned, the client
issued an RST. Hence the log entry SYN->SYN-ACK->RST.
Regards,
Frank
> -----Original Message-----
> From: Reed Mohn, Anders [mailto:[EMAIL PROTECTED]]
> Sent: Monday, August 28, 2000 4:00 AM
>
> Can anyone tell me why those "RST" (reset?)
> messages are sent?
> Is it safe to ignore them?
> As I said, this started popping up after I enabled the
> SYNDefender. If this is normal traffic, why is this picked up by
> it?
>
>
> Time Action Source Dest Comment
15:35:21 accept 195.70.x.y 193.216.148.226 len 60
> 15:35:21 accept 195.70.x.y 193.216.148.226 len 60
> 15:35:21 accept 195.70.x.y 193.216.148.226 len 60
> 15:35:21 accept 195.70.x.y 193.216.148.226 len 60
> 15:35:54 reject 195.70.x.y 193.216.148.226 message SYN ->
> SYN-ACK -> RST
> 15:35:54 reject 195.70.x.y 193.216.148.226 message SYN ->
> SYN-ACK -> RST
> 15:35:54 reject 195.70.x.y 193.216.148.226 message SYN ->
> SYN-ACK -> RST
> 15:35:54 reject 195.70.x.y 193.216.148.226 message SYN ->
> SYN-ACK -> RST
> 15:35:54 reject 195.70.x.y 193.216.148.226 message SYN ->
> SYN-ACK -> RST
> 15:35:54 reject 195.70.x.y 193.216.148.226 message SYN ->
> SYN-ACK -> RST
> 15:35:59 accept 195.70.x.y 193.216.148.226 len 60
> 15:35:59 accept 195.70.x.y 193.216.148.226 len 60
> 15:35:59 accept 195.70.x.y 193.216.148.226 len 60
-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.1
Comment: PGP or S/MIME (X.509) encrypted email preferred.
iQA/AwUBOasBt0RKym0LjhFcEQL2/ACgqK7zpUJLSDPuNzoszDYWER81Cd4AoJ9v
sKZiQR4jaM4seYCMnt4CxuPj
=oxhM
-----END PGP SIGNATURE-----
================================================================================
To unsubscribe from this mailing list, please see the instructions at
http://www.checkpoint.com/services/mailing.html
================================================================================
