RE: [cobalt-users] BIND (DNS server)

[shimi <shimi@xxxxxxxxxxxxxxxx>]

You see... the connection is OWNED by BIND.
And it's a *udp* port.
I've also noticed that it changes after every while (without rebooting).
It always sticks in around port 1050.

For instance, my redhat 7 box which is not even connected to the internet,
and hence can't be hacked got this thing:
anyways, it is named, and I *reinstalled* it.
it must be something with zone transfers, I guess.
netstat -pl yeilds that:
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address  Foreign Address  State PID/Program name   
udp        0      0 *:1058                  *:*  27509/named         

  Best regards,
     shimi [mailto:shimi@xxxxxxxxxxxxxxxx]


----

There are two major products that come out of Berkeley: LSD and BSD.
We don't believe this to be a coincidence.
   -- Jeremy S. Anderson

 Windows: "Where do you want to go today?"
   Linux: "Where do you want to go tomorrow?"
     BSD: "Are you guys coming or what?"

On Sat, 17 Mar 2001, Rodolfo Paiz wrote:

> > I've found out that the process "named" is listening at UDP port 1055.
> > Is that normal? (u can find out on your own raq with netstat -pl)
> > it's a raq3.
> 
> shimi,
> 
> I've never heard of that being normal; BIND listens on 53. If you didn't
> put it there... someone else did. Start checking out the rest of your
> machine for unauthorized entry.
> 
> --
> Rodolfo J. Paiz
> rpaiz@xxxxxxxxxxxxxx <mailto:rpaiz@xxxxxxxxxxxxxx>
> 
> 
> _______________________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To Subscribe or Unsubscribe, please go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users
>