-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 FWIN indicates a blocked incoming connection attempt, the S would indicate a tcp SYN packet, I believe. SYN is the first part of a TCP three-way handshake to establish a connection. Connection attempts to port 6346 are typically for a Gnutella file share.
Iana (http://www.iana.org/assignments/port-numbers) shows gnutella-svc 6346/tcp gnutella-svc gnutella-svc 6346/udp gnutella-svc gnutella-rtr 6347/tcp gnutella-rtr gnutella-rtr 6347/udp gnutella-rtr On Sat, 13 Apr 2002, Thomas Madhavan wrote: > FWIN,2002/03/27,22:29:31 +0:00 GMT,65.80.28.184:4440,62.253.86.237:6346,TCP > (flags:S) > > They're coming from different IPs, but directed to the same port? > > Could anyone tell me what 'Flags : S' is and also what 'FWIN' is about? I've -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE8uwkEEcEnk+U0Hj8RAiZeAKDOio2xy56AtYTt4mfYoo3sZnAZtgCgtQ6c VHBv78qv7aBriHM861T5EY8= =9dGJ -----END PGP SIGNATURE-----
