Hi Gary, Is it always the same port? OSSEC does 2 checks to see if a port is open, it tries to bind to the port and checks netstat. If it cannot bind to the port, but netstat does not see the port as open this alert will be triggered. So if a process has a port open for the bind check, but closes the port before the netstat check the alert will be triggered, but will be a fale positive.
I don't know enough about solaris w/zones to know if this fp scenario is likely. On Wed, Feb 16, 2011 at 2:45 PM, Sebel, Gary M. <[email protected]> wrote: > Hello > > I am testing OSSEC and have discovered that Solaris servers running with > local zones are reporting odd messages: > > 2011 Feb 16 08:27:25 (first time detected: 2011 Feb 09 14:59:37) > System Audit: Port '779'(tcp) hidden. Kernel-level rootkit or trojaned > version of netstat. > > > How is it finding the open ports and reporting on them? I read if it sees > open ports and then notices that they are not open from a netstat it will > report this error. Just not sure what command or script is reporting > ports listening on what seems like closed ports. > > We have tested with netcat and nmap, confirmed with netstat and lsof that > nothing listening on the port and verified this remotely all results show > the port closed. > > Thanks > -Gary > >
