Warning

 

Close

Confirm Action

Are you sure you wish to do this?

Confirm Cancel
BCM
User Panel

Site Notices
Posted: 3/18/2002 6:20:08 AM EDT
What is this?  My firewall guy at work today came by and said...  What are you doing to your computer?  I was like huh?  

He said my machine was trying to go out to a certain IP (RR ip in NYS) via port 9999.  It was happening a few times a minute.  He had millions of them in his log file.  [:D]

I closed everything and it dissapeared.  When I noticed the RR ip and NYS I guessed correctly.  AR15.com was doing something.

Goatboy What is this? Can it be turned off?
Link Posted: 3/18/2002 12:21:57 PM EDT
[#1]
Same at home.  

Everything is closed.  Open up IE6 and connect to www.ar15.com.  Check the log and my machine is trying to go out to 24.97.83.141  port "distinct - 9999" What is this and do we need it?  It appears to be random.  Sometimes nothing for 10-15 minutes then a bunch ever few minutes.
Link Posted: 3/18/2002 12:49:31 PM EDT
[#2]
Link Posted: 3/18/2002 12:51:35 PM EDT
[#3]
ROADRUNNER-COMMERCIAL-NYS (NETBLK-RR-COMMERCIAL-NYS)
  13241 Woodland Park Road
  Herndon, VA 20171
  US

  Netname: RR-COMMERCIAL-NYS
  Netblock: 24.97.0.0 - 24.97.127.255
  Maintainer: RCNS
Link Posted: 3/18/2002 1:28:43 PM EDT
[#4]
Well I think it just started last week.  I don't remember seeing them before.  Plus this makes it hard to surf at work.  There are a billion port 9999 errors on our firewall each day.

ARRRG.

Guess trying that other ar15.com host name won't work either if it is the ad's.  
Link Posted: 4/10/2002 10:11:07 PM EDT
[#5]
It's been a number of weeks since I've been able to connect from work.  I get the top menu (membership, equip. exchange, etc.), but nothing else. Yesterday I did a total take down of my browser settings at work....nada.

I got home tonight and took a peek at the source code and there was the port 9999 staring me in the face.  Non-port 80 sites won't go through my firewall at work, so it looks like I'm out of the AR15.com business until I can bribe Goatboy with pictures of goats or something....

:(
Link Posted: 4/10/2002 10:43:58 PM EDT
[#6]
What's a port 9999?
Link Posted: 4/10/2002 10:48:31 PM EDT
[#7]
I'm having the same problem at work.  At first, I thought they had blocked AR15.com, but now I know it's port 9999 that's keeping me from loading the site.  Stinks because I really liked to read messages during the slow times at work.

USPC40

-------------------------------------------------
[b][blue]NRA Life Member[/blue][/b] - [url]www.nra.org[/url]
[b][blue]GOA Life Member[/blue][/b] - [url]www.gunowners.org[/url]
[b][blue]SAF Supporter[/blue][/b] - [url]www.saf.org[/url]
[b][blue]SAS Supporter[/blue][/b] - [url]www.sas-aim.org[/url]

[img]www.ar15.com/members/albums/USPC40/alabamaflag.gif[/img]
Link Posted: 4/11/2002 3:55:25 AM EDT
[#8]
I don't think GB has seen this post yet.  Guess someone could email him and see if anything else can be done.

I'm wondering about an anonymous proxy.  Will that solve the 9999 problem or not?
Link Posted: 4/11/2002 4:31:12 AM EDT
[#9]
That is scary... my new boss started Monday and the last one didn't seem to care that I spent time on here.

If this guy is a jerk, this showing up on our firewall monitoring software may set off an alarm and cancel my browsing at work....

No, please don't make me have to dial in on my 33.6 modem....
Link Posted: 4/11/2002 5:13:33 AM EDT
[#10]
I posted this same question about a month ago and did not get a good answer.
[url]http://www.ar15.com/forums/topic.html?id=97632[/url]
Port Redirector?
Trojan?
BATF?
Carnivore?
Do You Know Where Your Packets Are ?
Link Posted: 4/11/2002 5:29:06 AM EDT
[#11]
Yeah, I saw that post and made a remark on the source code that address the port.

It seems to me that the first time I encountered this port access is about the time this boards speed came to screeching halt. I watch my ports pretty close.

After looking at the packets and based on my limited knowlege it looks benign. But you never know.  
Link Posted: 4/11/2002 5:30:15 AM EDT
[#12]
Link Posted: 4/11/2002 8:22:38 AM EDT
[#13]
Quoted:
This topics should be posted in the technical support forum if you want GB to answer![:)]
View Quote


True.  I posted it over in the Tech support forum.  Follow the link if you want to keep abreast of this.  [url]www.ar15.com/forums/topic.html?id=108223[/url]
Link Posted: 4/13/2002 11:32:15 AM EDT
[#14]
Quoted:
This topics should be posted in the technical support forum if you want GB to answer![:)]
View Quote


GB's actively posting in the folder, but hasn't commented on this issue yet.  It's possible that there's no work around yet (hopefully it's a "yet").  It's also possible that it's an 'undocumented feature' which will cut my AR15.com usage 98% :(
Link Posted: 4/13/2002 1:46:43 PM EDT
[#15]
Link Posted: 4/15/2002 9:20:03 AM EDT
[#16]
Quoted:
This topics should be posted in the technical support forum if you want GB to answer![:)]
View Quote


It was posted on tech support.....still no answer?

He seems to be avoiding this issue. There has been at least 3 threads and no GoatBoy comment.

Link Posted: 4/15/2002 9:46:08 AM EDT
[#17]
For the past few hours I've noticed no Ad's on the top or bottom of the pages.  Since I'm not at home I can't tell if I'm still sending out port 9999's.

Link Posted: 4/15/2002 10:13:18 AM EDT
[#18]
...did not get a good answer [from GoatBoy].
Trojan?
BATF?
Carnivore?
View Quote

Paranoia worthy of assaultweb.  Look, your machine is connecting to port 9999.  If you don't like that, then do something about it.z
Link Posted: 4/16/2002 12:06:23 AM EDT
[#19]
Look, your machine is connecting to port 9999.
View Quote


I only wish it connected on port 9999...

...sniff...sob...

It may be that to redesign the ad system back to port 80 around a handful of people may be a major overhaul and not something we're likely to see anytime soon.
Link Posted: 4/16/2002 6:12:05 AM EDT
[#20]
Close Join Our Mail List to Stay Up To Date! Win a FREE Membership!

Sign up for the ARFCOM weekly newsletter and be entered to win a free ARFCOM membership. One new winner* is announced every week!

You will receive an email every Friday morning featuring the latest chatter from the hottest topics, breaking news surrounding legislation, as well as exclusive deals only available to ARFCOM email subscribers.


By signing up you agree to our User Agreement. *Must have a registered ARFCOM account to win.
Top Top