RE: [cobalt-users] Services - Raq3

[flash22@xxxxxxx]

On Mon, 19 Feb 2001, Sean Chester wrote:

> f*ck.
> i thought i was on top of my recent hack attack(s?).
> 
> i have a whole load of these running, i rebooted, they are still there.
> 
> any idea how to kill these?
> 
> tcp        0      0 *:7937                  *:*                     LISTEN
> tcp        0      0 *:54320                 *:*                     LISTEN
> tcp        0      0 *:5742                  *:*                     LISTEN
> 
> hmm.. ircd? whats that up to?

You need to find the program associated with the ports...

try /usr/sbin/fuser -u 5742/tcp

lookup the pid to see what it is ...

ps e PID

ircd is probably random, it's port 6666 , probably just happened to use
that port so it got a name, I assume you are looking at ports on an *IDLE*
machine, it's
normal to have some high open ports on a machine with active network
traffic...(eg if you transfer a file via ftp you use an additional random
high port for the data etc)

gsh