[ntp:questions] other strange Linksys behaviour (phone home?)

Roman Maeder maeder+news at mathconsult.ch
Wed Jan 21 14:31:04 UTC 2004


Not strictly related to this topic, but another strange thing happens with the 
utility (Ver. 1.2) for the WPC54G wireless PC card. I noticed, first with a 
netstat, now very clearly with zonealarm, that when this utility starts up it 
tries to make a TCP connection to 66.161.11.20:13. This connection stays in 
the SYN_SENT stage. This IP doesn't seem to have a PTR record, but "whois" 
says it belongs to SBC Internet Services of Plano/Texas. and the subrange with 
this IP (66.161.11.0/25) belongs to Linksys, Irvine, CA (ARIN NET-66-161-11-0-1)!

Port 13 is "daytime" so this looks like another, rather clumsy, attempt to 
find out what time it is. It also allow Linksys to find out who in the world 
uses the WPC54G (except under Windows XP, where you would normally not use the 
utility).

Roman Maeder




More information about the questions mailing list