strange files being created

2001-04-21 Thread Jeff Coppock
I have a strange thing happening. I keep coming across this file in directories I've touched as root: -rw-r--r--1 root jeff0 Apr 19 09:47 0 There's nothing in the file and I delete it whenever I come across it. This is a laptop that only I use. Any ideas? thanks, jeff

Re: suspicious netstat ouput

2001-04-21 Thread Jonathan Freiermuth
On Sat, Apr 21, 2001 at 03:47:59AM -0400, hpknight wrote: > > Then I did a "find / -inum 127022" but there is no file with that > > inode. Uh oh. That can't be good either. The firewall runs an old redhat > > 6.2 install (haven't converted everything to debian, but I'm working on > > it!) with most

Re: suspicious netstat ouput

2001-04-21 Thread Bob Snyder
Newer versions of BIND bind to ports other than 53 for sending requests without having to be root (ie, above 1024) I suspect this is what you're seeing. Bob

Re: suspicious netstat ouput

2001-04-21 Thread Jonathan Freiermuth
On Sat, Apr 21, 2001 at 03:47:59AM -0400, hpknight wrote: > > Then I did a "find / -inum 127022" but there is no file with that > > inode. Uh oh. That can't be good either. The firewall runs an old redhat > > 6.2 install (haven't converted everything to debian, but I'm working on > > it!) with mos

Re: suspicious netstat ouput

2001-04-21 Thread Jonathan Freiermuth
On Sat, Apr 21, 2001 at 02:12:46AM -0500, Adam Keys wrote: > On 20 Apr 2001 18:26:00 -0400, Jonathan Freiermuth wrote: > > > tcp0 0 0.0.0.0:25 0.0.0.0:* LISTEN > > 0 1542 487/sendmail: accep > > udp0 0 0.0.0.0:1112

Re: suspicious netstat ouput

2001-04-21 Thread Bob Snyder
Newer versions of BIND bind to ports other than 53 for sending requests without having to be root (ie, above 1024) I suspect this is what you're seeing. Bob -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: suspicious netstat ouput

2001-04-21 Thread Jonathan Freiermuth
On Sat, Apr 21, 2001 at 02:12:46AM -0500, Adam Keys wrote: > On 20 Apr 2001 18:26:00 -0400, Jonathan Freiermuth wrote: > > > tcp0 0 0.0.0.0:25 0.0.0.0:* LISTEN 0 >1542 487/sendmail: accep > > udp0 0 0.0.0.0:1112

Weird networktraffic

2001-04-21 Thread pf
Hi there, I get some weird log messages from my denying catchall ipchains rule: Apr xx hh:mm:ss kernel: Packet log: input - eth0 PROTO=17 x.x.x.x:27300 x.x.x.x:58078 L=158 S=0x00 I=36151 F=0x T=55 (#82) That is UDP connections from port 27300 to port 58078. The source port sometimes i

Weird networktraffic

2001-04-21 Thread pf
Hi there, I get some weird log messages from my denying catchall ipchains rule: Apr xx hh:mm:ss kernel: Packet log: input - eth0 PROTO=17 x.x.x.x:27300 x.x.x.x:58078 L=158 S=0x00 I=36151 F=0x T=55 (#82) That is UDP connections from port 27300 to port 58078. The source port sometimes

does this pertain to debian-security? (was: Logging practices (and why does it suck in Debian?))

2001-04-21 Thread Giacomo Mulas
On Fri, 20 Apr 2001, Tim Uckun wrote: > Everything you say is 100% absolutely true. But it also has a price. For me > the price can be summed up like this. > When there is a new version of postgres out I want to be able to type > apt-get update && apt-get upgrade and have it installed. Right now

Re: suspicious netstat ouput

2001-04-21 Thread hpknight
On Fri, 20 Apr 2001, Jonathan Freiermuth wrote: > I got the following output from "netstat -elpn" on my firewall (kernel 2.4.2, > iptables). > > /-([EMAIL PROTECTED])-(166/ttyS0)-(17:56:42:Friday Apr 20)- > \-(/var/log)- > ROOT : netstat -elpn > Active Internet connections (only servers) > Pro

Re: suspicious netstat ouput

2001-04-21 Thread Adam Keys
On 20 Apr 2001 18:26:00 -0400, Jonathan Freiermuth wrote: > I got the following output from "netstat -elpn" on my firewall (kernel 2.4.2, > iptables). > > /-([EMAIL PROTECTED])-(166/ttyS0)-(17:56:42:Friday Apr 20)- > \-(/var/log)- > ROOT : netstat -elpn > Active Internet connections (only serv

does this pertain to debian-security? (was: Logging practices (andwhy does it suck in Debian?))

2001-04-21 Thread Giacomo Mulas
On Fri, 20 Apr 2001, Tim Uckun wrote: > Everything you say is 100% absolutely true. But it also has a price. For me > the price can be summed up like this. > When there is a new version of postgres out I want to be able to type > apt-get update && apt-get upgrade and have it installed. Right no

Re: suspicious netstat ouput

2001-04-21 Thread hpknight
On Fri, 20 Apr 2001, Jonathan Freiermuth wrote: > I got the following output from "netstat -elpn" on my firewall (kernel 2.4.2, >iptables). > > /-(root@cerberus)-(166/ttyS0)-(17:56:42:Friday Apr 20)- > \-(/var/log)- > ROOT : netstat -elpn > Active Internet connections (only servers) > Proto R