Rule 'TCP ack packet attack': Blocked: In TCP?

Archived from groups: comp.security.firewalls (More info?)

Here are some records (from a lot) from my Kerio 2.1.5:
"
Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
[204.179.240.10:80]->localhost:1130, Owner: no owner
Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
[204.179.240.10:80]->localhost:1131, Owner: no owner
Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
[204.179.240.10:80]->localhost:1087, Owner: no owner
Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
[204.179.240.10:80]->localhost:1088, Owner: no owner
Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
[204.179.240.10:80]->localhost:1089, Owner: no owner
Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
[204.179.240.10:80]->localhost:1090, Owner: no owner
Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
[204.179.240.10:80]->localhost:1091, Owner: no owner
Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
[204.179.240.10:80]->localhost:1092, Owner: no owner
Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
[204.179.240.10:80]->localhost:1094, Owner: no owner
Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
[204.179.240.10:80]->localhost:1093, Owner: no owner
"
etc. etc.
What do 'quote-2c.bloomberg.com' trying to achieve?
Thanks for any education.

Archived from groups: comp.security.firewalls (More info?)

"Dr. Pastor" <elpX@adsihqX.com> wrote in news:gycnc.12634$V97.11921
@newsread1.news.pas.earthlink.net:

> Thank you Duane:
> I have read the article but still do not
> understand what Bloomberg want.
> Would you elaborate please?
> Regards.
>

It's just a basic definition of the hand shake.

http://www.isoc.org/HMP/PAPER/144/html/node5.html

I don't know why a machine on the Bloomberg network is trying to make
contact with your machine, other than the machine has been compromised
and something on the machine is trying to run a DoS on your machine.

The DoS means that if your computer was to respond it would be so tied up
in responding to the requests, it would do nothing else but that and
nothing you wanted it to do. You would have to turn the machine off to
stop it.

Kerio is stopping it. But keep in mind that Kerio and the O/S can get so
involved in stopping the DoS requests; it's the same as if the requests
made it all the way to the machine any way.

You're not doing any business with Bloomberg are you?

Duane

Archived from groups: comp.security.firewalls (More info?)

"Dr. Pastor" <elpX@adsihqX.com> wrote news:V6anc.12452$Hs1.8762
@newsread2.news.pas.earthlink.net

> Here are some records (from a lot) from my Kerio 2.1.5:


> Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
> [204.179.240.10:80]->localhost:1130, Owner: no owner

<snip>

> etc. etc.
> What do 'quote-2c.bloomberg.com' trying to achieve?
> Thanks for any education.
>


Let's see... it's a TCP ack packet from source port 80 (www), to a high
numbered (>1024) local port, from from a machine running a web server.

Looks like you made an HTTP request, and they're trying to return it.