From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([69.77.167.62] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1JZL0J-000573-N9 for garchives@archives.gentoo.org; Wed, 12 Mar 2008 07:03:59 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id DA056E0627; Wed, 12 Mar 2008 07:03:30 +0000 (UTC) Received: from fire-eyes.org (makulit.fire-eyes.org [89.16.163.121]) by pigeon.gentoo.org (Postfix) with ESMTP id ADEABE0627 for ; Wed, 12 Mar 2008 07:03:30 +0000 (UTC) Received: from makulit.fire-eyes.org ([89.16.163.121] helo=[0.0.0.0]) by fire-eyes.org with esmtp (Exim 4.68) (envelope-from ) id 1JZKzF-0000OQ-Kv for gentoo-user@lists.gentoo.org; Wed, 12 Mar 2008 07:02:54 +0000 Message-ID: <47D7803F.7060906@fire-eyes.org> Date: Wed, 12 Mar 2008 00:03:27 -0700 From: fire-eyes User-Agent: Thunderbird 2.0.0.12 (X11/20080229) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 To: gentoo-user@lists.gentoo.org Subject: Re: [gentoo-user] Bizarre SSH connection reset References: <20080309080351.6kdf31qb4s08gggw@webmail.collinstarkweather.com> <200803102251.44347.michaelkintzios@gmail.com> <20080310192439.75cb71a1@pascal.spore.ath.cx> <200803110649.24883.michaelkintzios@gmail.com> <47D69785.7020901@kutulu.org> <642958cc0803110943n1464185du525c029df5e8c137@mail.gmail.com> In-Reply-To: <642958cc0803110943n1464185du525c029df5e8c137@mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: -2.5 (--) X-Spam-Report: Spam detection software, running on the system "makulit.fire-eyes.org", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: > Collin: it may not be a "5-second rule". It may just be cutting it off > after a certain amount of traffic has passed based on the protocol/port > used. But I'm just speculating. Let's hear what fire-eyes has to say. > > -- > - Mark Shields [...] Content analysis details: (-2.5 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1% [score: 0.0000] 0.1 AWL AWL: From: address is in the auto white-list X-Archives-Salt: 2d2084b5-f23e-4e0b-b1fd-a63542b250df X-Archives-Hash: d8f33982493604dd245b20d30c7e7a33 > Collin: it may not be a "5-second rule". It may just be cutting it off > after a certain amount of traffic has passed based on the protocol/port > used. But I'm just speculating. Let's hear what fire-eyes has to say. > > -- > - Mark Shields I don't have the pcap file yet ;) Not much I can do. -- gentoo-user@lists.gentoo.org mailing list