MBOX-Line: From mrc at CAC.Washington.EDU  Sun Aug  7 23:58:29 2005
To: imap-protocol@u.washington.edu
From: Mark Crispin <mrc@CAC.Washington.EDU>
Date: Fri Jun  8 12:34:36 2018
Subject: [Imap-protocol] Protocol Q: IMAP(s) svr (want tcp)-> IMAP client
In-Reply-To: <8764uhgp3l.fsf@windlord.stanford.edu>
References: <42F6B7FD.2000408@tlinx.org> <8764uhgp3l.fsf@windlord.stanford.edu>
Message-ID: <Pine.OSX.4.63.0508072357050.477@pangtzu.panda.com>

On Sun, 7 Aug 2005, Russ Allbery wrote:
> Linda Walsh <imap@tlinx.org> writes:
>> I notice (have for a long time) entries in my firewall' "denied" traffic
>> log that my ISP's imap server is attempting to initiate an inbound TCP
>> connection from server port 993 to a high numbered (>50000) client port.
> This is generally caused by confused firewalls that terminate a connection
> too quickly and then deny the final TCP ack from the server.  Check to see
> if these denied packets happen immediately after the end of a legitimate
> connection.

Note as well that a NAT box that times out a session too quickly can do 
this.  An IMAP session in IDLE can stay open for up to 30 minutes without 
any traffic, and the server can break the inactivity.

Most NAT boxes are stupid and assume that only clients break inactivity.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

