Report forwarded to debian-bugs-dist@lists.debian.org, Brian White <bcwhite@pobox.com>:
Bug#10615; Package netscape.   debian-bugs-dist@lists.debian.orgBrian White <bcwhite@pobox.com>  Sorry, this message was lost when this bug report was restored from a backup.   Acknowledgement sent to "Orn E. Hansen" <oe.hansen@oehansen.pp.se>:
New bug report received and forwarded. Copy sent to Brian White <bcwhite@pobox.com>.   "Orn E. Hansen" <oe.hansen@oehansen.pp.se>  Sorry, this message was lost when this bug report was restored from a backup.   Received: (at submit) by bugs.debian.org; 16 Jun 1997 21:02:06 +0000 Received: (qmail 25902 invoked from network); 16 Jun 1997 21:02:03 -0000 Received: from www.utbildning.halmstad.se (HELO www-server.utbildning.halmstad.se) (193.13.128.1) by master.debian.org with SMTP; 16 Jun 1997 21:02:01 -0000 Received: from OEHANSEN by www-server.utbildning.halmstad.se (NTMail 3.01.03) id sa041670; Mon, 16 Jun 1997 23:00:16 +0200 Received: (from oehansen@localhost) by oehansen.pp.se (8.8.5/8.8.5) id WAA07069 for submit@bugs.debian.org; Mon, 16 Jun 1997 22:41:18 +0200 Message-ID: X-Mailer: XFMail 1.0 [p0] on Linux Sender: oe.hansen@oehansen.pp.se Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit MIME-Version: 1.0 Date: Mon, 16 Jun 1997 22:06:04 +0200 (CET DST) Organization: Private home From: "Orn E. Hansen" To: submit@bugs.debian.org Subject: Continuous communications, even after netscape exits Package: netscape Version: 3.01-4 I'm not sure which package this should belong to. But since Netscape is the one who brings it about, I'll submit it here. I use a dial on demand connection, in which case I pay for the connection by the minute, like so many others :-) However, Netscape is issueing communications behind the walls, that continue even after Netscape has been exited. This particular subject, is one I noticed several months ago, as running keeps up the line continuously. And if Diald brings down the link, because of inactivity, it gets brought up again within a minute or two, by a issueing strange communications, that include broadcasts on my local network, and gateway communications. Whatever the authors of Netscape meant, by having this "feature" in Netscape, I would without hesitation, call this a severe security violation and a serious security risk to any serious system. As I estimate, that what I am seeing is the 'applets' and that they are continuously "playing ball". And that some shadow remains (java core?), when netscape exits. -- System Information Debian Release: 1.3 Kernel Version: Linux oehansen 2.0.30 #1 Fri May 9 10:44:25 EST 1997 i486 unknow n Versions of the packages netscape depends on: xpm4.7 Version: 3.4g-9 motifnls Version: 2.1-1.1 libc5 Version: 5.4.23-4 ldso Version: 1.9.2-3 (Provides Virtual Package libdl1) xlib6 Version: 3.2-6 ---------------------------------------------------------------------------- Ørn Einar Hansen oe.hansen@oehansen.pp.se oehansen@daimi.aau.dk voice+fax; +46 035 217194   Information forwarded to debian-bugs-dist@lists.debian.org, Brian White <bcwhite@pobox.com>:
Bug#10615; Package netscape.   debian-bugs-dist@lists.debian.orgBrian White <bcwhite@pobox.com>  Sorry, this message was lost when this bug report was restored from a backup.   Acknowledgement sent to Brian White <bcwhite@verisim.com>:
Extra info received and forwarded to list. Copy sent to Brian White <bcwhite@pobox.com>.   Brian White <bcwhite@verisim.com>  Sorry, this message was lost when this bug report was restored from a backup.   Received: (at 10615) by bugs.debian.org; 16 Jun 1997 21:51:20 +0000 Received: (qmail 29392 invoked from network); 16 Jun 1997 21:51:10 -0000 Received: from gatekeeper.verisim.com (207.134.10.201) by master.debian.org with SMTP; 16 Jun 1997 21:51:10 -0000 Received: from callandor ([192.168.1.3]) by gatekeeper.verisim.com with smtp id m0wdjfr-000eV6C (Debian Smail-3.2 1996-Jul-4 #2); Mon, 16 Jun 1997 17:50:35 -0400 (EDT) Sender: bcwhite Message-ID: <33A5B530.E70FAFD@verisim.com> Date: Mon, 16 Jun 1997 17:50:20 -0400 From: Brian White Organization: Verisim, Inc. http://www.verisim.com/ X-Mailer: Mozilla 3.01 (X11; I; Linux 2.0.29 i486) MIME-Version: 1.0 To: "Orn E. Hansen" , 10615@bugs.debian.org Subject: Re: Bug#10615: Continuous communications, even after netscape exits References: Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit > Package: netscape > Version: 3.01-4 > > I use a dial on demand connection, in which case I pay for the connection by > the minute, like so many others :-) However, Netscape is issueing > communications behind the walls, that continue even after Netscape has been > exited. This particular subject, is one I noticed several months ago, as > running keeps up the line continuously. And if Diald brings down the link, > because of inactivity, it gets brought up again within a minute or two, by a > issueing strange communications, that include broadcasts on my local network, > and gateway communications. We have 4 people using netscape 3 & 4 here behind a diald server and do not have this problem. Perhaps you have it set to check for new mail every minute or two? Brian ( bcwhite@verisim.com ) ------------------------------------------------------------------------------- measure with micrometer, mark with chalk, cut with axe, hope like hell   Information forwarded to debian-bugs-dist@lists.debian.org, Brian White <bcwhite@pobox.com>:
Bug#10615; Package netscape.   debian-bugs-dist@lists.debian.orgBrian White <bcwhite@pobox.com>  Sorry, this message was lost when this bug report was restored from a backup.   Acknowledgement sent to Dirk Eddelbuettel <edd@rosebud.sps.queensu.ca>:
Extra info received and forwarded to list. Copy sent to Brian White <bcwhite@pobox.com>.   Dirk Eddelbuettel <edd@rosebud.sps.queensu.ca>  Sorry, this message was lost when this bug report was restored from a backup.   Received: (at 10615) by bugs.debian.org; 16 Jun 1997 23:04:33 +0000 Received: (qmail 30455 invoked from network); 16 Jun 1997 23:04:26 -0000 Received: from mail.ican.net (198.133.36.5) by master.debian.org with SMTP; 16 Jun 1997 23:04:25 -0000 Received: from miles.econ.queensu.ca (root@ppp-109.toronto-02.ican.net [206.248.176.109]) by mail.ican.net (8.8.5/8.8.5) with ESMTP id SAA13439; Mon, 16 Jun 1997 18:58:42 -0400 (EDT) Received: by miles.econ.queensu.ca id m0wdkoY-0000aKC (Debian Smail-3.2 1996-Jul-4 #2); Mon, 16 Jun 1997 19:03:58 -0400 (EDT) Message-Id: Date: Mon, 16 Jun 1997 19:03:58 -0400 (EDT) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit To: Brian White , 10615@bugs.debian.org Cc: "Orn E. Hansen" Subject: Re: Bug#10615: Continuous communications, even after netscape exits In-Reply-To: <33A5B530.E70FAFD@verisim.com> References: <33A5B530.E70FAFD@verisim.com> X-Mailer: VM 6.32 under Emacs 19.34.1 From: Dirk Eddelbuettel Orn> Diald brings down the link, because of inactivity, it gets brought up Orn> again within a minute or two, by a issueing strange communications, Orn> that include broadcasts on my local network, and gateway Orn> communications. Brian> We have 4 people using netscape 3 & 4 here behind a diald server Brian> and do not have this problem. Perhaps you have it set to check for Brian> new mail every minute or two? 1. diald is _very_ configurable. Use tcpdump(8) to see what kind of packets keep the line open, and then adjust /etc/diald/standard.filter accordingly. 2. Run named(8) from the bind package as to cache dns queries. That does it for me, I can run netscape without it bringing diald up. 3. As a sledgehammer method, communicate a 'block' to diald when you when the line down. -- edd@debian.org edd@rosebud.sps.queensu.ca http://rosebud.sps.queensu.ca/~edd PGP key fingerprint = B2 49 75 BF 44 2C B7 AA 50 CB 19 7D 80 F7 CB DC -- By US Code Title 47, Sec.227(a)(2)(B), a computer/modem/printer meets the definition of a telephone fax machine. By Sec.227(b)(1)(C), it is unlawful to send any unsolicited advertisement to such equipment. By Sec.227(b)(3)(C), a violation of the aforementioned section is punishable by action to recover actual monetary loss, or $500, whichever is greater, for each violation. Please read the full text at http://www.law.cornell.edu/uscode/47/227.html.   Information forwarded to debian-bugs-dist@lists.debian.org, Brian White <bcwhite@pobox.com>:
Bug#10615; Package netscape.   debian-bugs-dist@lists.debian.orgBrian White <bcwhite@pobox.com>  Sorry, this message was lost when this bug report was restored from a backup.   Acknowledgement sent to "Orn E. Hansen" <oe.hansen@oehansen.pp.se>:
Extra info received and forwarded to list. Copy sent to Brian White <bcwhite@pobox.com>.   "Orn E. Hansen" <oe.hansen@oehansen.pp.se>  Sorry, this message was lost when this bug report was restored from a backup.   Received: (at 10615) by bugs.debian.org; 17 Jun 1997 17:03:37 +0000 Received: (qmail 16961 invoked from network); 17 Jun 1997 17:03:36 -0000 Received: from www.utbildning.halmstad.se (HELO www-server.utbildning.halmstad.se) (193.13.128.1) by master.debian.org with SMTP; 17 Jun 1997 17:03:32 -0000 Received: from OEHANSEN by www-server.utbildning.halmstad.se (NTMail 3.01.03) id ma041690; Tue, 17 Jun 1997 19:01:36 +0200 Received: (from oehansen@localhost) by oehansen.pp.se (8.8.5/8.8.5) id SAA07602; Tue, 17 Jun 1997 18:41:20 +0200 Message-ID: X-Mailer: XFMail 1.0 [p0] on Linux Sender: oe.hansen@oehansen.pp.se Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit MIME-Version: 1.0 In-Reply-To: <33A5B530.E70FAFD@verisim.com> Date: Tue, 17 Jun 1997 18:34:45 +0200 (CET DST) Organization: Private home From: "Orn E. Hansen" To: Brian White Subject: Re: Bug#10615: Continuous communications, even after netscape ex Cc: 10615@bugs.debian.org On 16-Jun-97 Brian White wrote: > >We have 4 people using netscape 3 & 4 here behind a diald server and do >not have this problem. Perhaps you have it set to check for new mail >every minute or two? > No, twice on weekdays from the crontab (in the afternoon), every 6 hours during weekends. I had diald totally debug all trafic last night, that is why I decided to report it. Before I ran Netscape (Navigator 3.01 gold), everything was normal... but as I ran Navigator and opened one single web site, this only happens after I open a web llink, there were continuous communications over the link... one was to my Gateway, the other was a broadcast to my local network. (ps. Those 4 people, must be running Netscape on a PC, or have a special versions from Mozilla & co., because Netscape 4.0 is not yet available for Linux.) ---------------------------------------------------------------------------- Xrn Einar Hansen oe.hansen@oehansen.pp.se oehansen@daimi.aau.dk voice+fax; +46 035 217194   Information forwarded to debian-bugs-dist@lists.debian.org, Brian White <bcwhite@pobox.com>:
Bug#10615; Package netscape.   debian-bugs-dist@lists.debian.orgBrian White <bcwhite@pobox.com>  Sorry, this message was lost when this bug report was restored from a backup.   Acknowledgement sent to "Orn E. Hansen" <oe.hansen@oehansen.pp.se>:
Extra info received and forwarded to list. Copy sent to Brian White <bcwhite@pobox.com>.   "Orn E. Hansen" <oe.hansen@oehansen.pp.se>  Sorry, this message was lost when this bug report was restored from a backup.   Received: (at 10615) by bugs.debian.org; 17 Jun 1997 17:05:40 +0000 Received: (qmail 16986 invoked from network); 17 Jun 1997 17:05:36 -0000 Received: from www.utbildning.halmstad.se (HELO www-server.utbildning.halmstad.se) (193.13.128.1) by master.debian.org with SMTP; 17 Jun 1997 17:05:32 -0000 Received: from OEHANSEN by www-server.utbildning.halmstad.se (NTMail 3.01.03) id pa041693; Tue, 17 Jun 1997 19:03:16 +0200 Received: (from oehansen@localhost) by oehansen.pp.se (8.8.5/8.8.5) id SAA07631; Tue, 17 Jun 1997 18:48:57 +0200 Message-ID: X-Mailer: XFMail 1.0 [p0] on Linux Sender: oe.hansen@oehansen.pp.se Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit MIME-Version: 1.0 In-Reply-To: Date: Tue, 17 Jun 1997 18:41:54 +0200 (CET DST) Organization: Private home From: "Orn E. Hansen" To: Dirk Eddelbuettel Subject: Re: Bug#10615: Continuous communications, even after netscape ex Cc: 10615@bugs.debian.org, Brian White On 16-Jun-97 Dirk Eddelbuettel wrote: > >1. diald is _very_ configurable. Use tcpdump(8) to see what kind of packets > keep the line open, and then adjust /etc/diald/standard.filter > accordingly. > I used the debug option in diald, with all debugging turned on (Mask 63), and I'd rather not mask off the packets that Netscape uses to keep my line open, as it is useful with other programs. >2. Run named(8) from the bind package as to cache dns queries. That does it > for me, I can run netscape without it bringing diald up. > This is a good idea, one I'll try out... >3. As a sledgehammer method, communicate a 'block' to diald when you when the > line down. > Ouch! :-) The whole idea of using diald, is to have the Network function transparent. Yet, I do find myself increasingly often piping that command through the fifo channel. :-( >-- > edd@debian.org edd@rosebud.sps.queensu.ca http://rosebud.sps.queensu.ca/~edd > PGP key fingerprint = B2 49 75 BF 44 2C B7 AA 50 CB 19 7D 80 F7 CB DC >-- >By US Code Title 47, Sec.227(a)(2)(B), a computer/modem/printer meets the >definition of a telephone fax machine. By Sec.227(b)(1)(C), it is unlawful to >send any unsolicited advertisement to such equipment. By Sec.227(b)(3)(C), a >violation of the aforementioned section is punishable by action to recover >actual monetary loss, or $500, whichever is greater, for each violation. >Please read the full text at http://www.law.cornell.edu/uscode/47/227.html. Beleave me, it is better to have silly laws... than this communist shit we have here in Scandinavia. ---------------------------------------------------------------------------- Xrn Einar Hansen oe.hansen@oehansen.pp.se oehansen@daimi.aau.dk voice+fax; +46 035 217194   Information forwarded to debian-bugs-dist@lists.debian.org, Brian White <bcwhite@pobox.com>:
Bug#10615; Package netscape.   debian-bugs-dist@lists.debian.orgBrian White <bcwhite@pobox.com>  Sorry, this message was lost when this bug report was restored from a backup.   Acknowledgement sent to Behan Webster <behanw@verisim.com>:
Extra info received and forwarded to list. Copy sent to Brian White <bcwhite@pobox.com>.   Behan Webster <behanw@verisim.com>  Sorry, this message was lost when this bug report was restored from a backup.   Received: (at 10615) by bugs.debian.org; 17 Jun 1997 20:13:49 +0000 Received: (qmail 26026 invoked from network); 17 Jun 1997 20:13:48 -0000 Received: from gatekeeper.verisim.com (207.134.10.201) by master.debian.org with SMTP; 17 Jun 1997 20:13:47 -0000 Received: from nybble ([192.168.1.2]) by gatekeeper.verisim.com with smtp id m0we4d1-000eUvC (Debian Smail-3.2 1996-Jul-4 #2); Tue, 17 Jun 1997 16:13:03 -0400 (EDT) Sender: behanw Message-ID: <33A6EFE2.38DD7137@verisim.com> Date: Tue, 17 Jun 1997 16:13:22 -0400 From: Behan Webster Organization: Verisim, Inc. http://www.verisim.com/ X-Mailer: Mozilla 3.01 (X11; I; Linux 2.0.28 i486) MIME-Version: 1.0 To: "Orn E. Hansen" , 10615@bugs.debian.org Subject: Re: Bug#10615: Continuous communications, even after netscape ex References: Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Orn E. Hansen wrote: > > On 16-Jun-97 Brian White wrote: > > >We have 4 people using netscape 3 & 4 here behind a diald server and do > >not have this problem. Perhaps you have it set to check for new mail > >every minute or two? > > > No, twice on weekdays from the crontab (in the afternoon), every 6 hours > during weekends. I think he means that you might have netscape setup to check for mail. > I had diald totally debug all trafic last night, that is why I decided to > report it. Before I ran Netscape (Navigator 3.01 gold), everything was > normal... but as I ran Navigator and opened one single web site, this only > happens after I open a web llink, there were continuous communications over > the link... one was to my Gateway, the other was a broadcast to my local > network. I don't know what to say. As Brian said, we've had netscape navigator (some people now using communicator) running from behind a diald link for a year now, and we've never seen the behaviour you describe. Once set up, diald has always behaved as expected. What are the packets that are keeping the link up? Using tcpdump, you should be able to see what the packets are, and then adjust your diald filter accordingly. When I first set up the diald link I setup tcpdump on one of the unused virtual-consoles to give me a better view of what was going on. I still go to that console to see how the link is working from time to time. If you are interested, I simply put the following in my inittab and did an "telinit q": 10:23:respawn:/usr/bin/nice -n 20 /usr/sbin/tcpdump -q -i ppp0 >/dev/tty10 2>&1 > (ps. Those 4 people, must be running Netscape on a PC, or have a special > versions from Mozilla & co., because Netscape 4.0 is not yet available for > Linux.) Actually, Netscape 4.0 _is_ available for linux (and has been at least since the beginning of April). I have copies of the beta 3 and beta 5 versions here. You just have to look under the communicator directories. Debian even has an installer for netscape 4.0 (called netscape-beta I believe). Behan -- Behan Webster mailto:behanw@verisim.com +1-613-224-7547 http://www.verisim.com/   Information forwarded to debian-bugs-dist@lists.debian.org, Brian White <bcwhite@pobox.com>:
Bug#10615; Package netscape.   debian-bugs-dist@lists.debian.orgBrian White <bcwhite@pobox.com>  Sorry, this message was lost when this bug report was restored from a backup.   Acknowledgement sent to "Orn E. Hansen" <oehansen@utbildning.halmstad.se>:
Extra info received and forwarded to list. Copy sent to Brian White <bcwhite@pobox.com>.   "Orn E. Hansen" <oehansen@utbildning.halmstad.se>  Sorry, this message was lost when this bug report was restored from a backup.   Received: (at 10615) by bugs.debian.org; 17 Jun 1997 23:02:41 +0000 Received: (qmail 3701 invoked from network); 17 Jun 1997 23:02:35 -0000 Received: from www.utbildning.halmstad.se (HELO www-server.utbildning.halmstad.se) (193.13.128.1) by master.debian.org with SMTP; 17 Jun 1997 23:02:34 -0000 Received: from [10.128.10.121] by www-server.utbildning.halmstad.se (NTMail 3.01.03) id ua041724; Wed, 18 Jun 1997 01:00:36 +0200 Received: from oehansen (oehansen@localhost [127.0.0.1]) by oehansen.pp.se (8.8.5/8.8.5) with SMTP id AAA08378; Wed, 18 Jun 1997 00:53:47 +0200 Sender: oe.hansen@oehansen.pp.se Message-ID: <33A71576.2672295B@utbildning.halmstad.se> Date: Wed, 18 Jun 1997 00:53:42 +0200 From: "Orn E. Hansen" X-Mailer: Mozilla 3.01Gold (X11; I; Linux 2.0.30 i486) MIME-Version: 1.0 To: Behan Webster CC: "Orn E. Hansen" , 10615@bugs.debian.org Subject: Re: Bug#10615: Continuous communications, even after netscape ex References: <33A6EFE2.38DD7137@verisim.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Behan Webster wrote: > > Orn E. Hansen wrote: > > > > On 16-Jun-97 Brian White wrote: > > > > >We have 4 people using netscape 3 & 4 here behind a diald server and do > > >not have this problem. Perhaps you have it set to check for new mail > > >every minute or two? > > > > > No, twice on weekdays from the crontab (in the afternoon), every 6 hours > > during weekends. > > I think he means that you might have netscape setup to check for mail. > And he was right about that too... I admit I was a little slow, but I got it eventually. Don't know why it went out to the Gateway though, all mail is defined to be on the local host. > > When I first set up the diald link I setup tcpdump on one of the > unused virtual-consoles to give me a better view of what was going on. > I still go to that console to see how the link is working from time > to time. If you are interested, I simply put the following in my > inittab and did an "telinit q": > > 10:23:respawn:/usr/bin/nice -n 20 /usr/sbin/tcpdump -q -i ppp0 >/dev/tty10 2>&1 > > > (ps. Those 4 people, must be running Netscape on a PC, or have a special > > versions from Mozilla & co., because Netscape 4.0 is not yet available for > > Linux.) > > Actually, Netscape 4.0 _is_ available for linux (and has been at least > since the beginning of April). I have copies of the beta 3 and beta > 5 versions here. You just have to look under the communicator > directories. Debian even has an installer for netscape 4.0 (called > netscape-beta I believe). > I'll take a better look... last time I looked, I saw one of those notices that read ("Not yet available for Linux") :-( After following Brian's lead, about the mail (I turned it off, manual checking only), and the tcpdump revealed that the broadcasts didn't come from Netscape, but were netbios datagrams. Somehow (don't ask me why), when Netscape was communicating with the gateway (which happens to be an NT box :-), it started sending netbios datagrams to my computer (which had samba), which replied... and an endless loop occurred... oh well. Thanks for the help guys. -- ---------------------------------------------------------------------------- Orn Einar Hansen oe.hansen@oehansen.pp.se oehansen@daimi.aau.dk voice+fax; +46 035 217194   Reply sent to Brian White <bcwhite@verisim.com>:
You have taken responsibility.   Brian White <bcwhite@verisim.com>  Sorry, this message was lost when this bug report was restored from a backup.   Notification sent to "Orn E. Hansen" <oe.hansen@oehansen.pp.se>:
Bug acknowledged by developer.   "Orn E. Hansen" <oe.hansen@oehansen.pp.se>  Sorry, this message was lost when this bug report was restored from a backup.   Received: (at 10615-done) by bugs.debian.org; 17 Jun 1997 23:56:51 +0000 Received: (qmail 4657 invoked from network); 17 Jun 1997 23:56:49 -0000 Received: from gatekeeper.verisim.com (207.134.10.201) by master.debian.org with SMTP; 17 Jun 1997 23:56:39 -0000 Received: from callandor ([192.168.1.3]) by gatekeeper.verisim.com with smtp id m0we86S-000eUyC (Debian Smail-3.2 1996-Jul-4 #2); Tue, 17 Jun 1997 19:55:40 -0400 (EDT) Sender: bcwhite Message-ID: <33A72407.73845F27@verisim.com> Date: Tue, 17 Jun 1997 19:55:31 -0400 From: Brian White Organization: Verisim, Inc. http://www.verisim.com/ X-Mailer: Mozilla 3.01 (X11; I; Linux 2.0.29 i486) MIME-Version: 1.0 To: "Orn E. Hansen" , 10615-done@bugs.debian.org CC: Behan Webster Subject: Re: Bug#10615: Continuous communications, even after netscape ex References: <33A6EFE2.38DD7137@verisim.com> <33A71576.2672295B@utbildning.halmstad.se> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit > Thanks for the help guys. No problem. I'll close this bug. Brian ( bcwhite@verisim.com ) ------------------------------------------------------------------------------- In theory, theory and practice are the same. In practice, they're not.   Information forwarded to debian-bugs-dist@lists.debian.org, Brian White <bcwhite@pobox.com>:
Bug#10615; Package netscape.   debian-bugs-dist@lists.debian.orgBrian White <bcwhite@pobox.com>  Sorry, this message was lost when this bug report was restored from a backup.   Acknowledgement sent to "Orn E. Hansen" <oehansen@utbildning.halmstad.se>:
Extra info received and forwarded to list. Copy sent to Brian White <bcwhite@pobox.com>.   "Orn E. Hansen" <oehansen@utbildning.halmstad.se>  Sorry, this message was lost when this bug report was restored from a backup.   Received: (at 10615) by bugs.debian.org; 18 Jun 1997 16:32:47 +0000 Received: (qmail 14055 invoked from network); 18 Jun 1997 16:32:47 -0000 Received: from www.utbildning.halmstad.se (HELO www-server.utbildning.halmstad.se) (193.13.128.1) by master.debian.org with SMTP; 18 Jun 1997 16:32:46 -0000 Received: from [10.128.16.10] by www-server.utbildning.halmstad.se (NTMail 3.01.03) id ya041754; Wed, 18 Jun 1997 18:30:30 +0200 Received: from oehansen (oehansen@localhost [127.0.0.1]) by oehansen.pp.se (8.8.5/8.8.5) with SMTP id IAA09089; Wed, 18 Jun 1997 08:13:30 +0200 Sender: oe.hansen@oehansen.pp.se Message-ID: <33A77C88.28E1722D@utbildning.halmstad.se> Date: Wed, 18 Jun 1997 08:13:28 +0200 From: "Orn E. Hansen" X-Mailer: Mozilla 3.01Gold (X11; I; Linux 2.0.30 i486) MIME-Version: 1.0 To: bcwhite@verisim.com CC: 10615@bugs.debian.org Subject: a (dis)closure :-) Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Oh, yes Brian... just so you don't think I was saying total bullshit, here is a tcpdump, taken "after" my last message. When 'sl0' receives these packets, the com line is down, Netscape has been exited several minutes ago, a remote session of Netscape (with this X display as a server), has also been shut down several minutes ago. and Bingo... its annoying... 02:23:34.433465 10.128.10.77.5418 > 206.246.79.86.www: F 195975265:195975265(0) ack 2113043407 win 15360 02:23:34.443465 localhost.1359 > 10.128.1.2.domain: 36148+ (44) 02:23:35.983465 10.128.10.77.5418 > 206.246.79.86.www: F 0:0(0) ack 1 win 15360 02:23:39.083465 10.128.10.77.5418 > 206.246.79.86.www: F 0:0(0) ack 1 win 15360 02:23:39.453465 localhost.1360 > 10.128.1.2.domain: 36148+ (44) 02:23:44.463465 localhost.1361 > 10.128.1.2.domain: 36148+ (44) 02:23:45.283465 10.128.10.77.5418 > 206.246.79.86.www: F 0:0(0) ack 1 win 15360 02:23:49.473465 localhost.1362 > 10.128.1.2.domain: 36148+ (44) 02:23:52.483465 localhost.1363 > 10.128.1.2.domain: 36148+ (44) 02:23:54.443465 localhost.1363 > 10.128.1.2.domain: 36149+ (43) 02:23:57.683465 10.128.10.77.5418 > 206.246.79.86.www: F 0:0(0) ack 1 win 15360 02:23:58.363465 10.128.10.99.xserver0 > forskning.kg.halmstad.se.6224: . 0:1460(1460) ack 1 win 15360 (DF) 02:23:59.453465 localhost.1364 > 10.128.1.2.domain: 36149+ (43) 02:24:04.463465 localhost.1365 > 10.128.1.2.domain: 36149+ (43) 02:24:09.473465 localhost.1366 > 10.128.1.2.domain: 36149+ (43) 02:24:12.483465 localhost.1367 > 10.128.1.2.domain: 36149+ (43) 02:24:22.483465 10.128.10.77.5418 > 206.246.79.86.www: F 0:0(0) ack 1 win 15360 -- ---------------------------------------------------------------------------- Orn Einar Hansen oe.hansen@oehansen.pp.se oehansen@daimi.aau.dk voice+fax; +46 035 217194   Information forwarded to debian-bugs-dist@lists.debian.org, Brian White <bcwhite@pobox.com>:
Bug#10615; Package netscape.   debian-bugs-dist@lists.debian.orgBrian White <bcwhite@pobox.com>  Sorry, this message was lost when this bug report was restored from a backup.   Acknowledgement sent to Brian White <bcwhite@verisim.com>:
Extra info received and forwarded to list. Copy sent to Brian White <bcwhite@pobox.com>.   Brian White <bcwhite@verisim.com>  Sorry, this message was lost when this bug report was restored from a backup.   Received: (at 10615) by bugs.debian.org; 18 Jun 1997 16:45:09 +0000 Received: (qmail 14209 invoked from network); 18 Jun 1997 16:45:07 -0000 Received: from gatekeeper.verisim.com (207.134.10.201) by master.debian.org with SMTP; 18 Jun 1997 16:45:06 -0000 Received: from callandor ([192.168.1.3]) by gatekeeper.verisim.com with smtp id m0weNqr-000eUvC (Debian Smail-3.2 1996-Jul-4 #2); Wed, 18 Jun 1997 12:44:37 -0400 (EDT) Sender: bcwhite Message-ID: <33A8107F.FE9142A@verisim.com> Date: Wed, 18 Jun 1997 12:44:27 -0400 From: Brian White Organization: Verisim, Inc. http://www.verisim.com/ X-Mailer: Mozilla 3.01 (X11; I; Linux 2.0.29 i486) MIME-Version: 1.0 To: "Orn E. Hansen" CC: 10615@bugs.debian.org, Behan Webster Subject: Re: a (dis)closure :-) References: <33A77C88.28E1722D@utbildning.halmstad.se> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit > Oh, yes Brian... just so you don't think I was saying total bullshit, > here is a tcpdump, taken "after" my last message. When 'sl0' receives > these packets, the com line is down, Netscape has been exited several > minutes ago, a remote session of Netscape (with this X display as a > server), has also been shut down several minutes ago. That's very odd. There should be a way to determine which process is sending the packet to that address. 02:23:35.983465 10.128.10.77.5418 > 206.246.79.86.www: F 0:0(0) ack 1 win 15360 You just need to find which process has port 5418 open. I can't recall how an the moment. Behan? Brian ( bcwhite@verisim.com ) ------------------------------------------------------------------------------- If you have a 50% chance of guessing right, you'll guess wrong 75% of the time.   Information forwarded to debian-bugs-dist@lists.debian.org, Brian White <bcwhite@pobox.com>:
Bug#10615; Package netscape.   debian-bugs-dist@lists.debian.orgBrian White <bcwhite@pobox.com>  Sorry, this message was lost when this bug report was restored from a backup.   Done: Brian White <bcwhite@verisim.com>; Maintainer for netscape is Brian White <bcwhite@pobox.com>.

Message received at 10615@bugs.debian.org:


Received: (at 10615) by bugs.debian.org; 18 Jun 1997 16:57:23 +0000
Received: (qmail 14427 invoked from network); 18 Jun 1997 16:57:21 -0000
Received: from gatekeeper.verisim.com (207.134.10.201)
  by master.debian.org with SMTP; 18 Jun 1997 16:57:21 -0000
Received: from nybble ([192.168.1.2]) by gatekeeper.verisim.com
	 with smtp id m0weO2i-000eUvC
	(Debian Smail-3.2 1996-Jul-4 #2); Wed, 18 Jun 1997 12:56:52 -0400 (EDT)
Sender: behanw
Message-ID: <33A81367.5ACB59B9@verisim.com>
Date: Wed, 18 Jun 1997 12:57:11 -0400
From: Behan Webster <behanw@verisim.com>
Organization: Verisim, Inc.  http://www.verisim.com/
X-Mailer: Mozilla 3.01 (X11; I; Linux 2.0.28 i486)
MIME-Version: 1.0
To: Brian White <bcwhite@verisim.com>
CC: "Orn E. Hansen" <oehansen@utbildning.halmstad.se>,
	10615@bugs.debian.org
Subject: Re: a (dis)closure :-)
References: <33A77C88.28E1722D@utbildning.halmstad.se> <33A8107F.FE9142A@verisim.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Brian White wrote:
> > Oh, yes Brian... just so you don't think I was saying total bullshit,
> > here is a tcpdump, taken "after" my last message.  When 'sl0' receives
> > these packets, the com line is down, Netscape has been exited several
> > minutes ago, a remote session of Netscape (with this X display as a
> > server), has also been shut down several minutes ago.
> 
> That's very odd.  There should be a way to determine which process is
> sending the packet to that address.
> 
> 02:23:35.983465 10.128.10.77.5418 > 206.246.79.86.www: F 0:0(0) ack 1 win 15360
> 
> You just need to find which process has port 5418 open.  I can't recall
> how an the moment.  Behan?

Well, I'm sure there are other ways, but what I do is, as root:

	lsof | grep 5418

(5418 being the socket number in this case)

"lsof" is a debian package, and _very_ useful.

I hope this helps.

Behan

-- 
Behan Webster     mailto:behanw@verisim.com
+1-613-224-7547   http://www.verisim.com/
Acknowledgement sent to Behan Webster <behanw@verisim.com>:
Extra info received and forwarded to list. Copy sent to Brian White <bcwhite@pobox.com>.   Behan Webster <behanw@verisim.com>  Sorry, this message was lost when this bug report was restored from a backup.