RE: Question about anonymous showing up in Logs

  • From: "John Tolmachoff \(Lists\)" <johnlist@xxxxxxxxxxxxxxxxxxx>
  • To: "'[ISAserver.org Discussion List]'" <isalist@xxxxxxxxxxxxx>
  • Date: Tue, 6 May 2003 10:29:46 -0700

The first packet (connection) is always anonymous. It is what starts the
session. 

John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com


> -----Original Message-----
> From: Larke, Daniel [mailto:LarkeD@xxxxxxxxxx]
> Sent: Tuesday, May 06, 2003 10:23 AM
> To: [ISAserver.org Discussion List]
> Subject: [isalist] Question about anonymous showing up in Logs
> 
> http://www.ISAserver.org
> 
> 
> Hey,
> 
> I have a lot of anonymous users showing up in my Webproxy logs for ISA.  I
> was wondering why they are there.  I do have "Ask unauthenticated users
for
> identification" check for both incoming and outgoing web request.
> 
> Another part of this puzzle is at the same time a web call is being made
> from the same computer to the same site.  The different about this call is
> that it has the user name.  Here is example of the log.
> 
>  anonymous            wisapidata.weatherbug.com       10.1.3.122      4167
> 299   00:05:50        05/04/03
>  anonymous            wisapidata.weatherbug.com       10.1.3.122      803
> 0     00:05:50        05/04/03
>  USOCE\diazk  wisapidata.weatherbug.com       10.1.3.122      138     523
> 00:05:50      05/04/03
> 
> Does spyware type applications make a web call under anonymous and still
get
> out even with "Ask unauthenticated users for identification" checked off.
> 
> I'm toying with the idea of blocking some sites and things like that, but
> thats a policatal battle.
> 
> Thanks and have a nice day.
> 
> Dan
> 
> ------------------------------------------------------
> List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
> ------------------------------------------------------
> Exchange Server Resource Site: http://www.msexchange.org/
> Windows Security Resource Site: http://www.windowsecurity.com/
> Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
> ------------------------------------------------------
> You are currently subscribed to this ISAserver.org Discussion List as:
> johnlist@xxxxxxxxxxxxxxxxxxx
> To unsubscribe send a blank email to $subst('Email.Unsub')



Other related posts: