Re: Connect requests to port 8091

On 2/20/18, Walter Hyland <[email protected]> wrote:
> Hello all
>
> Starting around February 1 one of my users started generating the following
> in the log once about every second, before that I see it only a few times a
> day:
> Feb 20 14:00:21.742 Privoxy(0000076c) Connect: Listening for new connections
> ...
> Feb 20 14:00:21.742 Privoxy(0000010c) Info: Request from 192.168.2.74
> denied. limit-connect{443 (implied default)} doesn't allow CONNECT requests
> to port 8091.

you don't have a next line in the log for what was blocked?  I just
enabled limit-connect & got this:

2018-02-20 18:32:43.450 000005ac Info: Request from 127.0.0.1 marked
for blocking. limit-connect{443} doesn't allow CONNECT requests to
foo.example.org.uk:8091
2018-02-20 18:32:43.452 000005ac Crunch: Blocked: foo.example.org.uk:8091

if you don't already have it, add this line to your privoxy config file
debug  1024 # Log the destination for each request Privoxy blocked,
and the reason why.


> I only noticed today and I don't know what could be generating that request.
> Is there an easy way to find out what's trying to go out

The only way I know of would be to take a look at the users' PC
If it's happening every second it shouldn't be that hard to figure out
what it is.

> or why that request is being generated?

They've got an automated something that's trying to connect to
https://something:8091/ ??

To figure out "why" I think you're going to have to take a look at the
machine generating those requests.

Regards
Lee