Jeff Vian wrote:
\My thoughts are that they probably know this is a server, and as such may have blocked TCP from that particular host IP address.They do know it's a web server, as they host our website. If TCP is being blocked though, how is it possible that can people visit the
It appears UDP and ICMP are getting through.
website? I realize that http connections come in through port 80, but the responses from the webserver don't. They leave from the
webserver through any port that apache deems neccessary, correct?
Elam Daly
Whiteware Inc.
Without further info it's hard to say. The output of tcpdump is very cryptic and hard to read, it's not even differentiating between TCP and UDP. Do you have ethereal or tethereal installed, it's much, much beter.
The final 3 packets to p5.www.dcn.yahoo.com.http don't show any responses, and look like retransmissions. My guess would be that the firewall has been setup to block all incoming TCP traffic to any port other than port 80. If the firewall isn't stateful that would block all responses to outgoing TCP connections.
--
Nigel Wade, System Administrator, Space Plasma Physics Group,
University of Leicester, Leicester, LE1 7RH, UK
E-mail : nmw@xxxxxxxxxxxx
Phone : +44 (0)116 2523548, Fax : +44 (0)116 2523555