Print Page | Close Window

No Data Received error

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7090
Printed Date: 27 December 2024 at 2:01am


Topic: No Data Received error
Posted By: meatboy
Subject: No Data Received error
Date Posted: 25 June 2014 at 7:46pm
Hi,

We are running Spamfilter v4.5.1.98.

I am continually, (maybe on every 20 seconds) receiving this entry below in the log. I've tried SF-ISP on another PC in our network and am getting the same message.

IP 192.168.1.104 is the address that SF-ISP is running on.

-------------
06/26/14 07:29:25:163 -- (52922384) Detected TCP Connection: 192.168.1.104
06/26/14 07:29:25:178 -- (52922384) Connection from: 192.168.1.104  -  Originating country : N/A
06/26/14 07:29:25:288 -- (52922384) No Data Received
06/26/14 07:29:25:303 -- (52922384) Disconnect
-------------

Any ideas what is happening here? or how to find out? I am concerned there is some rogue software on our network but we have done a sweep of all PCs.  If I look in Country: N/A there is a large count.

I would add to this that email is being delivered and spam quarantined while this is going on.
Thanks


Replies:
Posted By: LogSat
Date Posted: 25 June 2014 at 9:20pm
The logs indicate that the IP 192.168.1.104 (a private IP within your network - not a public IP on the internet) is probing port 25 on your SpamFilter server to see if it's open. It not sending any emails, as the line with the "No Data Received" indicates, rather it's just checking to see if the SMTP port is open.

If the interval is fairly regular, it's likely this is being done by an application within your network that is performing a monitoring/scanning of the network to see what servers are up and what services they are running. Applications like Solar Winds, NetIQ or IP Monitor are some of the ones that come to mind.

As a side-note, private IPs in the ranges:

10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255

will show up in SpamFilter with a country code of "N/A" as they are not public IP addresses, and thus they cannot be matched to any country.



-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: meatboy
Date Posted: 26 June 2014 at 1:54am
Thanks for the info Roberto, I now have a challenge to find out who, what or where its coming from.


Print Page | Close Window