Re: Anything suspicious?

Power wrote:
> [root@delllinux root]# netstat -an Active Internet connections
> (servers and established) Proto Recv-Q Send-Q Local Address
> Foreign Address         State tcp        0      0 0.0.0.0:21
> 0.0.0.0:*               LISTEN tcp        0      0 0.0.0.0:22
> 0.0.0.0:*               LISTEN tcp        0      0 192.168.1.1:22
> 192.168.1.8:1120 ESTABLISHED udp        0      0 0.0.0.0:67
> 0.0.0.0:* udp    65472      0 0.0.0.0:68              0.0.0.0:*
>  <<< THESE TWO LINES raw        0      0 0.0.0.0:1
> 0.0.0.0:*               7 <<< Active UNIX domain sockets (servers and
> established) Proto RefCnt Flags       Type       State         I-Node
> Path unix  7      [ ]         DGRAM                    914
> /dev/log unix  2      [ ]         DGRAM                    36162 unix
> 2      [ ]         DGRAM                    9529 unix  2      [ ]
> DGRAM                    1051 unix  2      [ ]         DGRAM
> 1011 unix  2      [ ]         DGRAM                    930
> 
> Can anyone tell me if the last 2 lines of hte Active Internet 
> connections seem fishy?  I've been monitoring connections before and
> I have never seen those 2 lines before.

As root, try it with the -p option (netstat -nap) to see the local
process that owns the socket.

-- 
Stephen Carville -- polluting the ranks of skeptics since 1995.
---------------------------------------------------------------
Government is actually the worst failure of civilized man. There has
never been a really good one, and even those that are most tolerable are
arbitrary, cruel, grasping and unintelligent.
             -- H. L. Mencken

-- 
Shrike-list mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/shrike-list