[ale] Totally OT

[Joe Steele]

Talk about weird.  I don't know how my last message got so scrambled.
All I know is that it was definitely MS's fault.  I resent the text to
myself and monitored the SMTP connection and the windows machine scrambled
the transmission of the text at the same point every time.

This time it's being sent from a linux box, so it no doubt will go through
flawlessly.

-------------------

I replicated the phenomenon.  I'm sorry to say that the truth makes far
less interesting reading than everyone's conjectures :-(

Among IE's list of recently typed URLs was the following URL:

ftp://ftp.efficient.com/pub/support/5000/5250/5250ins.pdf

When the dropdown box was opened, tcpdump (see tcpdump below) showed that
IE looked up ftp.efficient.com, and then proceeded to establish an ftp
connection (see ftp commands below) wherein IE changes directories into
/pub/support/5000/5250/.

A logical approach would have been for IE to wait and see if the user
actually clicks on the URL before taking any action, but logic is
apparently not the MS way.

--Joe

tcpdump:

10:31:08.750940 joe.local.2021 > lan2.local.domain: 1+ A?
ftp.efficient.com. (35)
10:31:08.750940 lan2.local.domain > joe.local.2021: 1 2/4/4 CNAME
webserv.efficient.com., A webserv.efficient.com (227)
10:31:08.920923 webserv.efficient.com.ftp > joe.local.2022: S
241651:241651(0) ack 92538493 win 8760 <mss 1460> (DF)
10:31:08.920923 user-37ka0pg.dialup.mindspring.com.61687 >
webserv.efficient.com.ftp: . ack 241652 win 8760 (DF)
10:31:09.070908 webserv.efficient.com.ftp > joe.local.2022: P 1:51(50) ack
1 win 8760 (DF)
10:31:09.070908 user-37ka0pg.dialup.mindspring.com.61687 >
webserv.efficient.com.ftp: P 0:16(16) ack 51 win 8710 (DF)
10:31:09.300885 webserv.efficient.com.ftp > joe.local.2022: P 51:123(72)
ack 17 win 8744 (DF)
10:31:09.300885 user-37ka0pg.dialup.mindspring.com.61687 >
webserv.efficient.com.ftp: P 16:32(16) ack 123 win 8638 (DF)
10:31:09.520863 webserv.efficient.com.ftp > joe.local.2022: P 123:177(54)
ack 33 win 8728 (DF)
10:31:09.660849 user-37ka0pg.dialup.mindspring.com.61687 >
webserv.efficient.com.ftp: . ack 177 win 8584 (DF)
10:31:09.890827 webserv.efficient.com.ftp > joe.local.2022: P 177:399(222)
ack 33 win 8728 (DF)
10:31:09.920824 user-37ka0pg.dialup.mindspring.com.61687 >
webserv.efficient.com.ftp: P 32:38(6) ack 399 win 8362 (DF)
10:31:10.080808 webserv.efficient.com.ftp > joe.local.2022: P 399:435(36)
ack 39 win 8722 (DF)
10:31:10.080808 user-37ka0pg.dialup.mindspring.com.61687 >
webserv.efficient.com.ftp: P 38:44(6) ack 435 win 8326 (DF)
10:31:10.240792 webserv.efficient.com.ftp > joe.local.2022: P 435:463(28)
ack 45 win 8716 (DF)
10:31:10.240792 user-37ka0pg.dialup.mindspring.com.61687 >
webserv.efficient.com.ftp: P 44:49(5) ack 463 win 8298 (DF)
10:31:10.390777 webserv.efficient.com.ftp > joe.local.2022: P 463:494(31)
ack 50 win 8711 (DF)
10:31:10.390777 user-37ka0pg.dialup.mindspring.com.61687 >
webserv.efficient.com.ftp: P 49:78(29) ack 494 win 8267 (DF)
10:31:10.600756 webserv.efficient.com.ftp > joe.local.2022: P 494:523(29)
ack 79 win 8682 (DF)
10:31:10.800736 user-37ka0pg.dialup.mindspring.com.61687 >
webserv.efficient.com.ftp: . ack 523 win 8238 (DF)
10:31:20.809737 webserv.efficient.com.ftp > joe.local.2022: . ack 80 win
8682 (DF)
10:31:20.819736 webserv.efficient.com.ftp > joe.local.2022: F 523:523(0)
ack 80 win 8682 (DF)
10:31:20.819736 user-37ka0pg.dialup.mindspring.com.61687 >
webserv.efficient.com.ftp: . ack 524 win 8238 (DF)

FTP commands:

220 webserv Microsoft FTP Service (Version 4.0).
USER anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
PASS IE30User@
230-Welcome to Efficient Network's Inc. FTP server.
230-  
230-Please send any questions, comments,or 
230-problem reports about this server. Send
230-e-mail to ftp at efficient.com.
230-
230-Guest login ok, access restrictions apply.
230 Anonymous user logged in.
feat
500 'FEAT': command not understood
syst
215 Windows_NT version 4.0
257 "/" is current directory.
CWD /pub/support/5000/5250/
250 CWD command successful.


-----Original Message-----
 From:	Irv Mullins [SMTP:irv at ellijay.com]
Sent:	Wednesday, October 27, 1999 11:41 AM
To:	ale at ale.org
Subject:	[ale] Totally OT


Forced to use IE for a few days, I noticed something interesting:
If you have your "home page" set to about:blank, then open Explorer,
and pull down the Address list in order to select a URL which you have
visited recently, but don't click on any URL, there is some data
transferred
over the net.

Now, I'm not paranoid or anything, but just what info gets sent out, and
who
do you suppose gets that info? Hmmm? Bet someone on this list knows.

Regards,
Irv