Rule 'TCP ack packet attack': Blocked: In TCP?

[Guest]

Archived from groups: comp.security.firewalls (More info?)

Here are some records (from a lot) from my Kerio 2.1.5:
"
Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
[204.179.240.10:80]->localhost:1130, Owner: no owner
Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
[204.179.240.10:80]->localhost:1131, Owner: no owner
Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
[204.179.240.10:80]->localhost:1087, Owner: no owner
Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
[204.179.240.10:80]->localhost:1088, Owner: no owner
Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
[204.179.240.10:80]->localhost:1089, Owner: no owner
Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
[204.179.240.10:80]->localhost:1090, Owner: no owner
Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
[204.179.240.10:80]->localhost:1091, Owner: no owner
Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
[204.179.240.10:80]->localhost:1092, Owner: no owner
Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
[204.179.240.10:80]->localhost:1094, Owner: no owner
Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
[204.179.240.10:80]->localhost:1093, Owner: no owner
"
etc. etc.
What do 'quote-2c.bloomberg.com' trying to achieve?
Thanks for any education.

 

[Guest]

Archived from groups: comp.security.firewalls (More info?)

"Dr. Pastor" <elpX@adsihqX.com> wrote in
news:19anc.12455$Hs1.11783@newsread2.news.pas.earthlink.net:

> Here are some records (from a lot) from my Kerio 2.1.5:
> "
> Rule 'TCP ack packet attack': Blocked: In TCP, quote-2c.bloomberg.com
> [204.179.240.10:80]->localhost:1130, Owner: no owner
<snipped>
> etc. etc.
> What do 'quote-2c.bloomberg.com' trying to achieve?
> Thanks for any education.
>

In Kerio, logging suspicious packets in Advanced > Miscellaneous view will
generate the "ack" packets logs.

See:
http://www.dslreports.com/forum/remark,6010939~root=kerio~mode=flat