On Fri, Dec 07, 2001 at 05:44:35PM -0800, you (George) wrote:
> For some reason, with no other connections open, netstat shows this
> when connected to live update:
[...]
> And this time I had the good sense to do a search for Level13.net at
> symentec's site before posting here, and it was not found.
Wait a second, in the output of netstat there's 'Level3', and
below you're talking about search of 'Level13'. Is it a typo ?
Btw. the last line:
TCP default:pop3 0.0.0.0:0 LISTENING
looks like pop3 server(port 110). Have you got any pop3 deamon on
your machine running ?
Now, these two lines higher:
> TCP default:1335 0.0.0.0:0 LISTENING
> TCP default:1335 unknown.Level3.net:80 ESTABLISHED
First of them is a symentec live-update server, and
the second is a normal established connection.
If Symantec is using its software to collecting any
informations about its users, all of it is done in
the established connection, with all the normal, obvious
data.
Maybe it is a time to run a sniffer and take a look at
packets send to the Symantec's server.
ps. I haven't use Windows from about two years, so I could
be wrong ;>
--
[ Wojtek gminick Walczak ][ http://hacker.pl/gminick/ ]
[ gminick (at) hacker.pl ][ gminick (at) klub.chip.pl ]
