Re: suspicious netstat ouput

2001-04-21 Thread Jonathan Freiermuth
On Sat, Apr 21, 2001 at 03:47:59AM -0400, hpknight wrote: > > Then I did a "find / -inum 127022" but there is no file with that > > inode. Uh oh. That can't be good either. The firewall runs an old redhat > > 6.2 install (haven't converted everything to debian, but I'm working on > > it!) with most

Re: suspicious netstat ouput

2001-04-21 Thread Bob Snyder
Newer versions of BIND bind to ports other than 53 for sending requests without having to be root (ie, above 1024) I suspect this is what you're seeing. Bob

Re: suspicious netstat ouput

2001-04-21 Thread Jonathan Freiermuth
On Sat, Apr 21, 2001 at 03:47:59AM -0400, hpknight wrote: > > Then I did a "find / -inum 127022" but there is no file with that > > inode. Uh oh. That can't be good either. The firewall runs an old redhat > > 6.2 install (haven't converted everything to debian, but I'm working on > > it!) with mos

Re: suspicious netstat ouput

2001-04-21 Thread Jonathan Freiermuth
On Sat, Apr 21, 2001 at 02:12:46AM -0500, Adam Keys wrote: > On 20 Apr 2001 18:26:00 -0400, Jonathan Freiermuth wrote: > > > tcp0 0 0.0.0.0:25 0.0.0.0:* LISTEN > > 0 1542 487/sendmail: accep > > udp0 0 0.0.0.0:1112

Re: suspicious netstat ouput

2001-04-21 Thread Bob Snyder
Newer versions of BIND bind to ports other than 53 for sending requests without having to be root (ie, above 1024) I suspect this is what you're seeing. Bob -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: suspicious netstat ouput

2001-04-21 Thread Jonathan Freiermuth
On Sat, Apr 21, 2001 at 02:12:46AM -0500, Adam Keys wrote: > On 20 Apr 2001 18:26:00 -0400, Jonathan Freiermuth wrote: > > > tcp0 0 0.0.0.0:25 0.0.0.0:* LISTEN 0 >1542 487/sendmail: accep > > udp0 0 0.0.0.0:1112

Re: suspicious netstat ouput

2001-04-21 Thread hpknight
On Fri, 20 Apr 2001, Jonathan Freiermuth wrote: > I got the following output from "netstat -elpn" on my firewall (kernel 2.4.2, > iptables). > > /-([EMAIL PROTECTED])-(166/ttyS0)-(17:56:42:Friday Apr 20)- > \-(/var/log)- > ROOT : netstat -elpn > Active Internet connections (only servers) > Pro

Re: suspicious netstat ouput

2001-04-21 Thread Adam Keys
On 20 Apr 2001 18:26:00 -0400, Jonathan Freiermuth wrote: > I got the following output from "netstat -elpn" on my firewall (kernel 2.4.2, > iptables). > > /-([EMAIL PROTECTED])-(166/ttyS0)-(17:56:42:Friday Apr 20)- > \-(/var/log)- > ROOT : netstat -elpn > Active Internet connections (only serv

Re: suspicious netstat ouput

2001-04-21 Thread hpknight
On Fri, 20 Apr 2001, Jonathan Freiermuth wrote: > I got the following output from "netstat -elpn" on my firewall (kernel 2.4.2, >iptables). > > /-(root@cerberus)-(166/ttyS0)-(17:56:42:Friday Apr 20)- > \-(/var/log)- > ROOT : netstat -elpn > Active Internet connections (only servers) > Proto R

Re: suspicious netstat ouput

2001-04-20 Thread Adam Keys
On 20 Apr 2001 18:26:00 -0400, Jonathan Freiermuth wrote: > I got the following output from "netstat -elpn" on my firewall (kernel 2.4.2, >iptables). > > /-(root@cerberus)-(166/ttyS0)-(17:56:42:Friday Apr 20)- > \-(/var/log)- > ROOT : netstat -elpn > Active Internet connections (only servers)

suspicious netstat ouput

2001-04-20 Thread Jonathan Freiermuth
I got the following output from "netstat -elpn" on my firewall (kernel 2.4.2, iptables). /-([EMAIL PROTECTED])-(166/ttyS0)-(17:56:42:Friday Apr 20)- \-(/var/log)- ROOT : netstat -elpn Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address

suspicious netstat ouput

2001-04-20 Thread Jonathan Freiermuth
I got the following output from "netstat -elpn" on my firewall (kernel 2.4.2, iptables). /-(root@cerberus)-(166/ttyS0)-(17:56:42:Friday Apr 20)- \-(/var/log)- ROOT : netstat -elpn Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address Sta