Re: [PLUG] What is www-ldap-gw Protocol

[Matt Mossholder <matt@mossholder.com>]

On Sat, May 19, 2012 at 9:54 AM, Casey Bralla <MailList@nerdworld.org> wrote:

I'm Âcurrently hacking a "ixp3" clock (it's one of those groovy persistance of
vision clocks, but this one gets messages through the internet).

I've been using wireshark to sniff the packets, and one of ht efirst things this
clock does is contact the mothership with this protocol:

Source           Destination            ÂPacket
ixp3-Clock-Address   Âwww.myixp3.com Âwww-ldap-gw > http [SYN] Seq=0 Win=1500
Len=0 MSS=536


www.myixp3.com Âixp3-Clock-Address   Âhttp > www-ldap-gw [SYN, ACK] Seq=0
Ack=1 Win=16384 Len=0 MSS=1460


ixp3-Clock-Address   Âwww.myixp3.com Âwww-ldap-gw > http [ACK] Seq=1 Ack=1
Win=1500 Len=0



After this sequence is finished, it relies on http traffic to communicate.

Can anybody explain what this is doing?

You're paying too much attention to the source port. It just happened to choose a random port for the source that also happens to have an entry in /etc/services . ÂIt is probably just straight HTTP.Â

www-ldap-gw is port 1760, a perfectly reasonable port for an application to use as a source port.

  Â--Matt

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug