By chance you didn't leave IE on when you shut down??? I've seen some banner ads run something similar to a lease type connection. Yahoo and flipside.com leave a lot of residual connections like that tied directly to Win32 clients.
On Wednesday 27 February 2002 22:24, Scott C. Best wrote: > Anyone ever seen this one before: I shut down my > WinNT server today to see what TCP/IP traffic a Windows > machines makes at powerdown. That is, I was tcpdump'ing on > another LAN member. And I saw this: > > 03:29:14.553849 192.168.123.130.1853 > 209.73.225.9.80: R > 804849242:804849242(0) win 0 (DF) (ttl 128, id 7442) > 03:29:14.553965 192.168.123.130.1852 > 209.73.225.9.80: R > 804738457:804738457(0) win 0 (DF) (ttl 128, id 7698) > > I did a whois on 209.73.225.9 and it came up with > something from either "PFM Communications: or "Cydoor > Technologies" (they seem to have overlapping IP space). > > I've just started poking around to learn more > about these, check for spy-ware reports, adding -vv to the > tcpdump...but I thought I'd ask to see if anyone hear has > seen it before. > > cheers, > Scott > > PS: A Windows machine does spew some NetBIOS traffic to > the broadcast address at shutdown. :) Of course...when > *doesn't* it do that... > > > _______________________________________________ > Leaf-user mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/leaf-user -- ~Lynn Avants aka Guitarlynn guitarlynn at users.sourceforge.net http://leaf.sourceforge.net If linux isn't the answer, you've probably got the wrong question! _______________________________________________ Leaf-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user
