My firewall logs are telling me that my web server is trying to connect from port 80 to ports above 1024 on the outside. What is this?!
If you are seeing dropped packets from port 80 on your web server (or from port 25 on your mail server) to high ports on the outside, they usually DO NOT mean that your web server is trying to connect somewhere. They are the result of the firewall timing out a connection, and seeing the server retransmitting old responses (or trying to close the connection) to the client. TCP connections always involve packets traveling in BOTH directions in the connection. If you are able to see the TCP flags in the dropped packets, you’ll see that the ACK flag is set but not the SYN flag, meaning that this is actually not a new connection forming, but rather a response of a previously formed connection.
Related Questions
- My firewall logs are telling me that my web server is trying to connect from port 80 to ports above 1024 on the outside. What is this?!
- When I connect to Abjects, my firewall shows the server trying to connect to my TCP ports. Why?
- My firewall is telling me CrashPlan is trying to connect on odd ports. Why is that?
