Security Incidents: Re: Strange Behaviour !

[Christian Vogel <chris () obelix hedonism cx>]

Hi,

> Active Internet connections (servers and established)
> Proto Recv-Q Send-Q Local Address           Foreign Address         State
> tcp        0      0 0.0.0.0:32768        0.0.0.0:*               LISTEN
> tcp        0      0 0.0.0.0:98              0.0.0.0:*               LISTEN
newer "net-tools" have the ability to display the process which is listening
on a specific port. As root execute "netstat -lnp" and you'll see:

[root () emil /root]# netstat -lnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State  PID/Program name
tcp        0      0 0.0.0.0:32768 0.0.0.0:*       LISTEN 461/rpc.statd
(...)
tcp        0      0 0.0.0.0:6000  0.0.0.0:*       LISTEN 811/X
(...)

        Chris

-- 
Everything is gone;
Your life's work has been destroyed.
Squeeze trigger (yes/no)?
-- David Carlson

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com