Sort of off topic, but maybe related to SRO

PR0METHEUS · Post by **PR0METHEUS** » Mon Jun 18, 2007 1:09 pm

While connected to SRO, I went to a commandline and ran 'netstat' to see what connections my computer is making. Along with an entry for my SRO connection, it is showing a long list of the following:

tcp 0 0 <hostname>.local:<port number> 64.152.34.142:ftp TIME_WAIT
tcp 0 0 <hostname>.local:<port number> 64.152.34.142:ftp TIME_WAIT
tcp 0 0 <hostname>.local:<port number> 64.152.34.142:ftp TIME_WAIT
tcp 0 0 <hostname>.local:<port number> 64.152.34.142:ftp TIME_WAIT
tcp 0 0 <hostname>.local:<port number> 64.152.34.142:ftp TIME_WAIT

Where <hostname> is the hostname of my computer and <port number> is a different port for each entry. 64.152.34.142 belongs to Level 3 Communications according to http://www.arin.net/whois.

This is occurring in Ubuntu while running SRO. I didn't notice if these connections existed before I logged into SRO or not. Has anyone seen anything like this before? Any ideas why it's making those FTP connections?

PsYch008 · Post by **PsYch008** » Mon Jun 18, 2007 2:20 pm

lol... hax. :shock:

but yea, no idea.

PR0METHEUS · Post by **PR0METHEUS** » Mon Jun 18, 2007 2:53 pm

Interesting... I FTP'd to that site myself with an anonymous account, and there are things in there for Joymax and SRO and GameGuard. I wonder if Windows systems make these connections as well. I'm not at a Windows system (with SRO on it) currently so I can't verify.

Website · Post by **satman83** » Mon Jun 18, 2007 3:09 pm

PsYch008 wrote:lol... hax.

Deacon · Post by **Deacon** » Mon Jun 18, 2007 3:11 pm

I also checked.. I don't make any of those connections :o

PR0METHEUS · Post by **PR0METHEUS** » Mon Jun 18, 2007 3:14 pm

hmm maybe it's just an Ubuntu thing, or a wine thing. I have no idea.

Deacon · Post by **Deacon** » Mon Jun 18, 2007 3:20 pm

PR0METHEUS wrote:hmm maybe it's just an Ubuntu thing, or a wine thing. I have no idea.

Prolly wine thing. That connect to yourself to get some stuff to run SRO ?

PR0METHEUS · Post by **PR0METHEUS** » Mon Jun 18, 2007 3:37 pm

Possibly. It's not connecting to my own system. The 64.152 IP address is not mine. I don't think wine would need to connect with a third party to get additional data it needs to make a connection or to execute software. All of the SRO data should already be on my local system. Besides, there are about 30+ of those connections I listed above for FTP to that IP address. They're all in a TIME_WAIT state.

Deacon · Post by **Deacon** » Mon Jun 18, 2007 4:01 pm

PR0METHEUS wrote:Possibly. It's not connecting to my own system. The 64.152 IP address is not mine. I don't think wine would need to connect with a third party to get additional data it needs to make a connection or to execute software. All of the SRO data should already be on my local system. Besides, there are about 30+ of those connections I listed above for FTP to that IP address. They're all in a TIME_WAIT state.

Mind checking your open ports?

PR0METHEUS · Post by **PR0METHEUS** » Mon Jun 18, 2007 4:24 pm

On the Linux box itself? I'm not sure how to check that in Ubuntu. My firewall has all ports from the outside world closed except one that I use. Nothing to do with FTP though.

I don't know if there's another place to check in Ubuntu, but 'iptables --list' shows no rules on any of the 3 chains. /etc/hosts.allow had 'all:all allow' I know, that wasn't good... I changed it to all:localhost allow.

Even with hosts.allow set to allow all services from all sources to connect, the firewall on my router should stop them unless they connect through the one open port, which would need a service listening behind it.

ddcc · Post by **ddcc** » Mon Jun 18, 2007 8:36 pm

I think I've figured it out... see http://silkroadforums.com/posting.php?m ... ly&t=36267. I've remembered seeing these connections before when helping someone over at Tavern.

PR0METHEUS · Post by **PR0METHEUS** » Mon Jun 18, 2007 8:57 pm

ddcc wrote:I think I've figured it out... see http://silkroadforums.com/posting.php?m ... ly&t=36267. I've remembered seeing these connections before when helping someone over at Tavern.

Seems to be possibly like Joymax's "photobucket" for guild and union icons maybe. Just a thought.