[posted and cc'ed, as seems to be the custom for this list]

On Tue, 5 Oct 2004, D. Archibald Smart wrote:

> On Tue, 5 Oct 2004 12:07:56 -0700, Jeffrey Goldberg
> <jeffrey at goldmark dot org> wrote:

>> ipmon[75]: 11:07:08.443851 sis0 @0:15 b
>>    192.168.1.51,63864 -> 66.111.4.160,993 PR tcp len 20 101 -AFP IN

>> I haven't been able to check systematically (syslogd on OS X sucks),
>> but my impression is that this is only happening with IMAP and IMAPs.

> im in the exact same boat. im using mail.app under osx to read imaps
> (port993) mail. i see these logs occasionally as well. im not sure if
> its a mail.app thing or a m0n0wall thing.

Hmm, that is consistent with what I have going on.  I'm using Mail.app 
(along with other IMAP clients) on OS X, and as I said, I only recall 
seeing this sort of stuff ports 143 and 993.

If nobody has some insight into this, I know what I should do next.  I 
should set up ethereal or something like that to capture out-going IMAP 
packets and try to see what correlates with what I have on the firewall 
logs.  Of course, whether I actually get around to doing what I should do 
next is another question.

-j

-- 
Jeffrey Goldberg                            http://www.goldmark.org/jeff/
  Relativism is the triumph of authority over truth, convention over justice
  Hate spam?  Boycott MCI! http://www.goldmark.org/jeff/anti-spam/mci/