Probleme de sécu ? tunnelling ?

[megs]

Salut,

j’utilise squid et squid-gard, et personne s’en pleind…vu que ca améliore grandement notre traffic. Mais, il me reste quelques doute concernant l’aspect sécurité que j’ai pu soulevé avec NETSTAT… et j’aimerais savoir si c’est normal.

tcp 1 1 10.0.0.2:50036 logc18.xiti.com:www CLOSING
tcp 1 1 10.0.0.2:34600 mymsn.hotmail.msn.c:www CLOSING
tcp 0 0 intranet:webcache 192.168.1.7:1792 ESTABLISHED
tcp 0 0 intranet:webcache 192.168.1.7:1793 ESTABLISHED
tcp 1 1 10.0.0.2:48373 165.246.154.195.in-:www CLOSING
tcp 0 1534 intranet:webcache 192.168.1.7:1583 LAST_ACK
tcp 0 0 10.0.1.2:42374 mymsn.hotmail.msn.c:www ESTABLISHED
tcp 0 0 10.0.1.2:48170 host.109.175.23.62.:www ESTABLISHED
tcp 1 1 10.0.0.2:44556 mymsn.hotmail.msn.c:www CLOSING
tcp 0 0 intranet:webcache 192.168.1.108:1075 TIME_WAIT
tcp 0 0 10.0.1.2:51867 host.100.175.23.62.:www ESTABLISHED
tcp 0 0 intranet:webcache 192.168.1.108:1082 ESTABLISHED
tcp 0 1448 intranet:webcache 192.168.1.106:1084 ESTABLISHED
tcp 0 0 intranet:webcache 192.168.1.108:1081 TIME_WAIT
tcp 0 0 intranet:webcache 192.168.1.108:socks TIME_WAIT
tcp 0 0 intranet:ssh 192.168.1.10:1122 ESTABLISHED
tcp 0 0 intranet:webcache 192.168.1.27:1140 ESTABLISHED
tcp 0 0 intranet:webcache 192.168.1.27:1143 ESTABLISHED
tcp 0 0 intranet:webcache 192.168.1.89:1085 ESTABLISHED
tcp 0 0 intranet:webcache 192.168.1.21:1160 ESTABLISHED
tcp 0 0 intranet:webcache 192.168.1.21:1159 ESTABLISHED
tcp 1 1 10.0.0.2:42524 logtestfiltre.xiti.:www CLOSING
tcp 0 0 10.0.0.2:56367 a195.22.198-199.dep:www ESTABLISHED
tcp 0 0 10.0.1.2:35435 195.220.181.16:www ESTABLISHED
tcp 0 0 10.0.0.2:43964 80.15.236.176:www ESTABLISHED
tcp 0 0 10.0.1.2:57043 194.25.47.22:www ESTABLISHED
tcp 0 0 localhost.localdo:39465 localhost.locald:domain TIME_WAIT
tcp 0 0 localhost.localdo:39464 localhost.locald:domain TIME_WAIT
tcp 0 0 intranet:webcache 192.168.1.7:1710 CLOSE_WAIT
tcp 0 0 intranet:webcache 192.168.1.10:1189 TIME_WAIT
tcp 0 0 intranet:webcache 192.168.1.10:1190 ESTABLISHED
tcp 0 805 10.0.0.2:43198 fg-in-f147.google.c:www ESTABLISHED
tcp 0 0 10.0.0.2:43198 fg-in-f147.google.c:www ESTABLISHED
tcp 0 0 10.0.1.2:52607 80.15.236.199:www ESTABLISHED
tcp 0 0 intranet:webcache 192.168.1.7:1756 TIME_WAIT
tcp 0 0 intranet:webcache 192.168.1.7:1757 TIME_WAIT
tcp 0 0 intranet:webcache 192.168.1.7:1752 FIN_WAIT2
tcp 0 363 10.0.1.2:58967 guru1.grisoft.cz:www ESTABLISHED
tcp 0 0 10.0.1.2:57659 80.15.236.149:www ESTABLISHED
tcp 0 0 10.0.1.2:57659 80.15.236.149:www ESTABLISHED
tcp 0 0 10.0.1.2:41280 static-fxfeeds.nllb:www ESTABLISHED
tcp 0 0 intranet:webcache 192.168.1.7:1750 TIME_WAIT
tcp 0 0 intranet:webcache 192.168.1.7:1745 TIME_WAIT
tcp 0 0 intranet:webcache 192.168.1.7:1742 TIME_WAIT
tcp 0 0 10.0.0.2:56906 80.15.236.176:www ESTABLISHED
tcp 0 0 intranet:webcache 192.168.1.7:1788 ESTABLISHED
tcp 0 0 10.0.0.2:56906 80.15.236.176:www ESTABLISHED
tcp 0 0 intranet:webcache 192.168.1.7:1788 ESTABLISHED
tcp 0 0 intranet:webcache 192.168.1.7:1789 ESTABLISHED
tcp 0 0 intranet:webcache 192.168.1.7:1790 TIME_WAIT
tcp 0 0 intranet:webcache 192.168.1.7:1791 ESTABLISHED
tcp 0 0 intranet:webcache 192.168.1.7:1784 ESTABLISHED
tcp 0 0 intranet:webcache 192.168.1.7:1786 ESTABLISHED
tcp 0 0 10.0.1.2:52552 195.220.181.16:www ESTABLISHED
tcp 0 0 intranet:webcache 192.168.1.7:1787 TIME_WAIT
tcp 0 0 intranet:webcache 192.168.1.7:1780 FIN_WAIT2
tcp 0 0 intranet:webcache 192.168.1.7:1782 ESTABLISHED
tcp 0 0 intranet:webcache 192.168.1.7:1783 ESTABLISHED
tcp 0 0 intranet:webcache 192.168.1.7:1776 ESTABLISHED
tcp 0 0 intranet:webcache 192.168.1.7:1777 FIN_WAIT2
tcp 0 0 intranet:webcache 192.168.1.7:1778 FIN_WAIT2
tcp 0 0 intranet:webcache 192.168.1.7:1772 TIME_WAIT
tcp 0 0 intranet:webcache 192.168.1.7:1773 TIME_WAIT
tcp 0 0 intranet:webcache 192.168.1.7:1764 TIME_WAIT
tcp 0 0 intranet:webcache 192.168.1.7:1765 TIME_WAIT
tcp 0 0 intranet:webcache 192.168.1.7:1760 TIME_WAIT

les autres clients prennent 1 à deux ports maximum, celui là en prend une vingtaine à lui tout seul. et j’en passe…
Tunnelling ?

[mattotop]

c’est normal, ce sont toutes les requètes en parrallèle faites par squid pour le compte de tes clients.