Topic 'Re: [Kerio 2.x] What is "no owner"?' in forum 'Kerio - Tiny Support' - dslreports.com

Re: [Kerio 2.x] What is "no owner"?

Thu, 06 Sep 2007 19:19:44 EDT

Bill_MI posted : Yep, you already have the right insight how things really work. There's also a likelihood, Kerio 2.x older technology will get worse and worse at getting things right as the network stack evolves further. Not much you can do about that except... be wise. :-)

Re: [Kerio 2.x] What is "no owner"?

Thu, 06 Sep 2007 14:53:52 EDT

shearer posted : Thanks Bill. Your explanation makes sense.

Among many proggies I've been testing recently, one now comes to mind, a TCP-based traceroute app which runs the trace using TCP SYN packets - which I believe Kerio picks up as "No Owner". Sort of like how the Windows built-in ping which leaves "Owner:TCPIP Kernel Driver" instead of "Owner: PING.EXE".

Re: [Kerio 2.x] What is "no owner"?

Thu, 06 Sep 2007 06:32:24 EDT

Bill_MI posted : I think it means it cannot determine the owner and most likely the application closed before Kerio could get the info.

That's the OUTBOUND case you have. An INBOUND case happens a lot on things like late DNS replies or connection attempts after closing the program (like bittorrent).

Re: [Kerio 2.x] What is "no owner"?

Thu, 06 Sep 2007 06:10:20 EDT

shearer posted : No, I always had the "Log suspicious packets" option disabled. The entry was from a 'catch all remaining outbound' rule I placed at the bottom of ruleset (i.e. block all outgoing from any application)

Re: [Kerio 2.x] What is "no owner"?

Thu, 06 Sep 2007 04:56:14 EDT

BlitzenZeus posted : Well your log is incomplete to start as Kerio doesn't log anything without a rule, unless its from that 'suspicous' setting which just logs garbage/fragmented packets anyway.

[Kerio 2.x] What is "no owner"?

Sat, 01 Sep 2007 14:37:47 EDT

shearer posted : This thread is merely here to satisfy my curiosity.

Some entries in KPF 2.1.5 logs show the application as "No owner", per sample below.

Blocked: Out TCP, localhost:9126->64.233.189.104:80, Owner: no owner

Well I roughly guess that "no owner" means no application owns the packet. But I was wondering if some knowlegable guru here can provide a deeper explanation as to the causes behind it. Such as why does a packet has "no owner"? thanks