[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [cobalt-users] last bit of hacker droppings.



Jeff Bilicki wrote:

Resolved that, thanks. Killed the bogus init and restored the other bogus
system files.
Just installed logcheck and netstat shows these ports which I didn't see
before:
udp        0      0 0.0.0.0:7938            0.0.0.0:*
raw        0      0 0.0.0.0:1               0.0.0.0:*               7
raw        0      0 0.0.0.0:6               0.0.0.0:*               7
Any idea what ports these are?



The two raw port are normal, put the udp at port 7938 isn't, do a netstat -nuap
to see which process is controlling it and investigate that process.


7938 is the NetWorker's private portmapper, running in a forked process of nsrexecd, which also listens on port 7937.

Byron

--
Byron Servies       Sun Microsystems, Inc.    bservies@xxxxxxx