Network packet question.

[Bob Chiodini]

On Mon, 2006-02-13 at 12:19 -0500, Steven W. Orr wrote:
> I just recently started running dovecot. Now I'm seeing funny things 
> bouncing off my firewall. Here's an example.
> 
> Feb 13 10:20:16 saturn kernel: [FIAIF_SCAN]:IN= OUT=eth0 SRC=207.172.210.41 DST=65.42.55.47 LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF PROTO=TCP SPT=113 DPT=60707 WINDOW=0 RES=0x00 ACK RST URGP=0
> Feb 13 10:20:19 saturn kernel: [FIAIF_SCAN]:IN= OUT=eth0 SRC=207.172.210.41 DST=65.42.55.47 LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF PROTO=TCP SPT=113 DPT=60707 WINDOW=0 RES=0x00 ACK RST URGP=0
> 
> I am only using dovecot for my internal network. I do not allow access to 
> dovecot from the outside.
> 
> My firewall allows outgoing auth packets. i.e., packets with destination 
> ports set to 113(auth). Also, My firewall does not allow incoming packets 
> with destination ports of 113(auth)
> 
> It doesn't make any sense to me. I am the 207.172.210.41 and I seem to be 
> the src and the src port is 113 which makes no sense at all. How is it 
> possible for my server to be trying to connect to a remote machine with 
> src port 113?
> 
> Does this make sense?
> 
> -- 
> Time flies like the wind. Fruit flies like a banana. Stranger things have  .0.
> happened but none stranger than this. Does your driver's license say Organ ..0
> Donor?Black holes are where God divided by zero. Listen to me! We are all- 000
> individuals! What if this weren't a hypothetical question?
> steveo at syslang.net
> 

Steve,

Are you doing anything with 

The Earth Echo Galleries
   48 Florissant Avenue
   Framingham, MA 01701
   US

They are 65.42.55.47.  Seemingly in the same area as you.

Bob...