-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 21.01.2012 02:39, Michael Mol wrote: > On Fri, Jan 20, 2012 at 6:34 PM, Grant <emailgr...@gmail.com> > wrote: >>>>>>>> My firewall is blocking periodic outbound connections >>>>>>>> to port 3680 on a Rackspace IP. How can I find out >>>>>>>> more about what's going on? Maybe which program is >>>>>>>> generating the connection requests? >>>>>>> >>>>>>> Uh, a packet sniffer? >>>>>>> >>>>>>> I have an old laptop here that I have a second >>>>>>> (cardbus) network card in. Really cheap and cheerful - >>>>>>> the sort of thing you can pick up on freecycle. It's >>>>>>> been a while since I've done anything like this, but >>>>>>> you should be able to stick a box like that between the >>>>>>> router and the rest of your network, run Wireshark and >>>>>>> filter on that port. If the connection is encrypted >>>>>>> then at least you'll see the originating IP. >>>>>> >>>>>> I've actually got the originating local IP from the >>>>>> shorewall log. I'm just trying to figure out which >>>>>> program and maybe which user on that system is generating >>>>>> the outbound requests to port 3680. Is there any way to >>>>>> get more info without setting up a new box? >>>>>> >>>>>>> I don't think it's relevant that the IP belongs to >>>>>>> Rackspace - don't they just hire (virtual) servers to >>>>>>> anyone that wants one? >>>>>> >>>>>> Yeah I just meant the request could be going to >>>>>> "anyone". >>>>>> >>>>>> - Grant >>>>> >>>>> Are you running NPDS in your LAN and is it configured to >>>>> access any sites on rackspace? -- Regards, Mick >>>> >>>> I am not running NPDS. I looked it up when I was researching >>>> port 3680 and read about it for the first time. I know which >>>> machine is making the requests. Any way to drill down >>>> further? >>> >>> If the machine is running linux, then 'watch "lsof -n|grep >>> TCP|grep 3680"' as root is a sloppy but effective way to find >>> it. There's probably some way to set up a firewall rule on the >>> host in question that logs out the user and (possibly) PID of >>> the connection, but I don't know. >> >> All of my systems run Gentoo. :) Where does watch come from? > > shortcircuit@saffron ~ $ equery b `which watch` > /usr/lib64/portage/pym/portage/package/ebuild/config.py:353: > UserWarning: 'cache.metadata_overlay.database' is deprecated: > /etc/portage/modules (user_auxdbmodule, modules_file)) * Searching > for /usr/bin/watch ... sys-process/procps-3.2.8_p11 > (/usr/bin/watch) shortcircuit@saffron ~ $ > > Incidentally, does anyone know why all my portage-related > executions get that 'cache.metadata_overlay.database' warning? I've > been seeing it for weeks, even on fresh installs. I would have > assumed a bug like that would have been fixed by now. > >
You get the warning, because you hat a directory /etc/portage/modules - - simply remove it (or move it, if you are afraid to break something). -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.18 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJPGhmmAAoJEJwwOFaNFkYcBFQIAJlWjVqACiqCSxwNnigFvXfa olRedLttuzZUGcJKsx59gptBeaRxSc/kQ7oEai6QSmFzY7nq5bsz3QMtJEB5QJpo rOwD844f6pKRKv4GWjCg++1W6LJJcbMs4s0TARLM1+o+uaTC8Lgb/tjdJCov6cWF Hhl/KxRpdy/mCL/QB7/kOQRL/lDryy23xoxCln8S60xzD8pWQ/HsPdMNKg2LDpOL RxKyywJQ/y35OTJU60w6vgkPhJnhQQ4WgzrruvsNCSS60t1Mr51XXdmj5ATEChCw qaxml/3x1eHc4L2j5GekjED0PL2fROOTYujoDlpuTHGTUy5tHNvww+/2upqLf9U= =t8zl -----END PGP SIGNATURE-----
