On Tue, 13 Sep 2005 15:50:12 EDT, Joseph S D Yao said: > Oh, and also ... please consider that some firewalls try to discern > whether the connection on port 25 is from a mail server or from Telnet.
OK, I'll bite. A long time ago, I saw code that would trap the fact that many telnet binaries would send option negotiation on ports other than 21. What are they keying off now? Since the host in question gave a 'Connection Refused', it obviously made its decision based on the initial SYN packet. So what are they looking at? TCP options? initial window? other? 16:25:37.240700 IP h80ad2467.async.vt.edu.43404 > listserv.vt.edu.smtp: S 1026334142:1026334142(0) win 5840 <mss 1460,sackOK,timestamp 3672334 0,nop,wscale 2> 16:25:57.420455 IP h80ad2467.async.vt.edu.45093 > listserv.vt.edu.smtp: S 1074086420:1074086420(0) win 5840 <mss 1460,sackOK,timestamp 3677379 0,nop,wscale 2> One was a telnet connection, one was Sendmail. Damned if I can tell.. ;) Of course, a busticated firewall trying to tell the difference *would* explain why they aren't accepting mail. :)
pgpqpvDjw52Hj.pgp
Description: PGP signature
