Question about "daytime"

[Capps]

I was aware of the meaning of Daytime and its normal
usage. The question is, why does my Windoze boxen try to get
time from Microsoft ? I certainly didn't turn on any feature
that requested time sync from Microsoft, and have been
unable to find any way to disable this persistent connection.
(Short of blocking it at the firewall)

Is this some new feature of Windows 2000 ?

I don't see any new process/task running that would seem to
be related to getting the time of day.

TCPview indicates that the process is "System:8", this
would seem be something buried in the Windows system.

There appear to be two possibilities.
1. This is a new feature inside of Windows 2000 and it
is not optional, or configurable.
2. This is something else that is conversing with Microsoft
over TCP port 13.

Until I can figure out which of the above is true, I guess that
I'll just block TCP destination port 13 (Daytime).

or,

Unblock it, and monitor with Ethereal. See what data is
actually being transferred. :-)

Thanks,
Don Capps



"CA was in NJ"
<cainnj.cjb.net@cainnj.REVERSE_TO_REPLY__SPAMMERS_ SHOT_ON_SIGHT> wrote in
message news:IIucnRA27_bYoqaiU-KYgg@giganews.com...
> Capps wrote:
>
> > Is there some reason that my Windows 2000 clients would
> > be needing to talk to www.us.microsoft.com on TCP port 13
> > (Daytime) ? Or, should I be blocking this at the firewall ?
>
> It's setting the clock.
>
> http://www.faqs.org/rfcs/rfc867.html
>

[mto]

"Capps" <capps@iozone.org> wrote in message
news:6LQ_a.8343$CN.1430@nwrddc03.gnilink.net...
> I was aware of the meaning of Daytime and its normal
> usage. The question is, why does my Windoze boxen try to get
> time from Microsoft ? I certainly didn't turn on any feature
> that requested time sync from Microsoft, and have been
> unable to find any way to disable this persistent connection.
<SNIP>
Have you not noticed that invariably MS products come with all features
turned on by default leaving the user to figure out what to turn off? And
that they never give you the first clue what something might be doing? Or
that even if you do something like set scripts to "prompt" IE will tell you
"Most scripts are safe to run. Do you want to run scripts?"

Don't know about NT 2000 but XP checks the time of the system clock about
weekly. Gives two choices - microsoft and the national clock. Right click
on the time in your mainscreen toolbar while online. Click on the top tab
that says Internet. Choose which time source you want to use.

[Capps]

Mto,

I guess your suggestion works for WinXP, however in
Winblows 2k, there is no tab that says Internet related
to the clock :-( Guess they thought that it was un-needed :-(

Thanks,
Don Capps

"mto" <nobody@dontsendmeanyspam.thanks> wrote in message
news:elednT4lx6WrUaGiU-KYvA@seg.net...
>
> "Capps" <capps@iozone.org> wrote in message
> news:6LQ_a.8343$CN.1430@nwrddc03.gnilink.net...
> > I was aware of the meaning of Daytime and its normal
> > usage. The question is, why does my Windoze boxen try to get
> > time from Microsoft ? I certainly didn't turn on any feature
> > that requested time sync from Microsoft, and have been
> > unable to find any way to disable this persistent connection.
> <SNIP>
> Have you not noticed that invariably MS products come with all features
> turned on by default leaving the user to figure out what to turn off? And
> that they never give you the first clue what something might be doing? Or
> that even if you do something like set scripts to "prompt" IE will tell
you
> "Most scripts are safe to run. Do you want to run scripts?"
>
> Don't know about NT 2000 but XP checks the time of the system clock about
> weekly. Gives two choices - microsoft and the national clock. Right
click
> on the time in your mainscreen toolbar while online. Click on the top tab
> that says Internet. Choose which time source you want to use.
>
>

[Jay T. Blocksom]

On Fri, 15 Aug 2003 08:04:01 -0400, in <alt.privacy.spyware>, "mto"
<nobody@dontsendmeanyspam.thanks> wrote:
>
[snip]
>
> Don't know about NT 2000 but XP checks the time of the system clock about
> weekly. Gives two choices - microsoft and the national clock.
[snip]

But surely, it doesn't use the stone-age "Daytime" service for this.

--

Jay T. Blocksom
--------------------------------
Appropriate Technology, Inc.
usenet01[at]appropriate-tech.net


"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: E-Mail address in "From:" line is INVALID! Remove +SPAMBLOCK to mail.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unsolicited advertising sent to this E-Mail address is expressly prohibited
under USC Title 47, Section 227. Violators are subject to charge of up to
$1,500 per incident or treble actual costs, whichever is greater.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

[mto]

"Jay T. Blocksom" <usenet01+SPAMBLOCK@appropriate-tech.net> wrote in message
news:mk2rjvoljvig4nql4sfanc5f1t4vuukeso@news.rcn.c om...
> On Fri, 15 Aug 2003 08:04:01 -0400, in <alt.privacy.spyware>, "mto"
> <nobody@dontsendmeanyspam.thanks> wrote:
> >
> [snip]
> >
> > Don't know about NT 2000 but XP checks the time of the system clock
about
> > weekly. Gives two choices - microsoft and the national clock.
> [snip]
>
> But surely, it doesn't use the stone-age "Daytime" service for this.
>
> --

No clue what service it uses. Mine is set to time.nist.gov. Just giving
Capps an explanation as to why his machine is constantly trying to fetch the
time from MS.

[Capps]

Win2k, Daytime queries have stopped.

My Win2k box was generating TCP port 13 (Daytime) requests to
Microsoft.net. I blocked all inbound and outbound traffic on port
13, at the firewall. (With Reject) That caused the Win2k box to
begin retrying the Daytime requests very rapidly, and rotating
across multiple servers. So... I updated the firewall rules to just
DROP all port 13 traffic. That slowed the queries from the Win2k
box. But, lo and behold, several days have passed and guess what,
the Win2k box is no longer generating any daytime queries at all.
Hmmm..... something magical ? or some spyware that just got
tired of retrying ? Can't say for sure, but at least the annoying
traffic has stopped.

Enjoy,
Don Capps

"mto" <nobody@dontsendmeanyspam.thanks> wrote in message
news:X_6cnUuMSLfhPt2iXTWJhA@seg.net...
>
> "Jay T. Blocksom" <usenet01+SPAMBLOCK@appropriate-tech.net> wrote in
message
> news:mk2rjvoljvig4nql4sfanc5f1t4vuukeso@news.rcn.c om...
> > On Fri, 15 Aug 2003 08:04:01 -0400, in <alt.privacy.spyware>, "mto"
> > <nobody@dontsendmeanyspam.thanks> wrote:
> > >
> > [snip]
> > >
> > > Don't know about NT 2000 but XP checks the time of the system clock
> about
> > > weekly. Gives two choices - microsoft and the national clock.
> > [snip]
> >
> > But surely, it doesn't use the stone-age "Daytime" service for this.
> >
> > --
>
> No clue what service it uses. Mine is set to time.nist.gov. Just giving
> Capps an explanation as to why his machine is constantly trying to fetch
the
> time from MS.
>
>

[Jay T. Blocksom]

On Mon, 18 Aug 2003 20:17:44 GMT, in <alt.privacy.spyware>, "Capps"
<capps@iozone.org> wrote:
>
> Win2k, Daytime queries have stopped.
>
[snip]

> But, lo and behold, several days have passed and guess what,
> the Win2k box is no longer generating any daytime queries at all.
> Hmmm..... something magical ? or some spyware that just got
> tired of retrying ? Can't say for sure, but at least the annoying
> traffic has stopped.
>
[snip]

Weird.

Have you rebooted since this crap started? Made any other changes to the
system setup?

--

Jay T. Blocksom
--------------------------------
Appropriate Technology, Inc.
usenet01[at]appropriate-tech.net


"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: E-Mail address in "From:" line is INVALID! Remove +SPAMBLOCK to mail.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unsolicited advertising sent to this E-Mail address is expressly prohibited
under USC Title 47, Section 227. Violators are subject to charge of up to
$1,500 per incident or treble actual costs, whichever is greater.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -