VESARiA Network Security Specialists
About Vesaria Services Consulting Partners Research Customers Contact Us

Firewall Testing



C.8 Is my firewall trying to connect outside?

  My firewall logs are telling me that my web server is trying to connect from port 80 to ports above 1024 on the outside. What is this?!

If you are seeing dropped packets from port 80 on your web server (or from port 25 on your mail server) to high ports on the outside, they usually DO NOT mean that your web server is trying to connect somewhere.

They are the result of the firewall timing out a connection, and seeing the server retransmitting old responses (or trying to close the connection) to the client.

TCP connections always involve packets traveling in BOTH directions in the connection.

If you are able to see the TCP flags in the dropped packets, you'll see that the ACK flag is set but not the SYN flag, meaning that this is actually not a new connection forming, but rather a response of a previously formed connection.

Read point 8 below for an in-depth explanation of what happens when TCP connections are formed (and closed)

Vesaria, LLC

Firewall FAQ
Table of Contents

Previous Section: C.7 What software uses what FTP mode?

Next Section: C.9 The anatomy of a TCP connection

Find out more about VESARiA Firewall Testing.

© 2000 - 2018 Vesaria Network Security Specialists        
   About Vesaria   |   Legal   |   Privacy   |   Contact