Re: [squid-users] Possible squid exploit?

On 13.05 07:34, Lizzy Dizzy wrote:
> I have a network setup such that my router will only throw dest port 80 &
> 8080 traffic (Transparent proxy) to my squid server.
> Squid is listening to port 80 and 8080 only. I've got an acl that deny the
> CONNECT method for being used for all ports except 443.
>
> When I do a netstat I found out that:
>
> myserverip:44271 202.103.8.114:4365
>
> where 203.103.8.114 is ftp1.tvdown.com

that's 202.103.8.114, not 203.103.8.114

> The strange thing is that I cannot see any mention of this IP or domain
> inside access.log.
>
> What could have cause squid to connect to that high port?

it doesn't have to be squid. try find out which process has open port 44271
on 'myserverip'. (UN*X systems: lsof -p tcp:44271)

-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
REALITY.SYS corrupted. Press any key to reboot Universe.