You'll just have to track down what application is messing with the ports. What do the servers do? What processes do they run that are short lived and use ports in the alerted ranges?
On Wed, Feb 16, 2011 at 3:14 PM, Sebel, Gary M. <[email protected]> wrote: > Dan > > It is the same each run on the system. How do you check to see if the port > is open in solaris prior to doing the netstat. I ask because I have had > another person confirm that they also see none of the ports reported as > open. > > So from the runs on the 15th and the 16th the same set of ports are open > in the 600/700 range. I am trying to test this out on another solaris > server not running zones. > > Thanks > -gary > > On 2/16/11 2:53 PM, "dan (ddp)" <[email protected]> wrote: > >>Hi Gary, >>Is it always the same port? >>OSSEC does 2 checks to see if a port is open, it tries to bind to the >>port and checks netstat. If it cannot bind to the port, but netstat >>does not see the port as open this alert will be triggered. >>So if a process has a port open for the bind check, but closes the >>port before the netstat check the alert will be triggered, but will be >>a fale positive. >> >>I don't know enough about solaris w/zones to know if this fp scenario is >>likely. >> >>On Wed, Feb 16, 2011 at 2:45 PM, Sebel, Gary M. <[email protected]> wrote: >>> Hello >>> >>> I am testing OSSEC and have discovered that Solaris servers running with >>> local zones are reporting odd messages: >>> >>> 2011 Feb 16 08:27:25 (first time detected: 2011 Feb 09 14:59:37) >>> System Audit: Port '779'(tcp) hidden. Kernel-level rootkit or trojaned >>> version of netstat. >>> >>> >>> How is it finding the open ports and reporting on them? I read if it >>>sees >>> open ports and then notices that they are not open from a netstat it >>>will >>> report this error. Just not sure what command or script is reporting >>> ports listening on what seems like closed ports. >>> >>> We have tested with netcat and nmap, confirmed with netstat and lsof >>>that >>> nothing listening on the port and verified this remotely all results >>>show >>> the port closed. >>> >>> Thanks >>> -Gary >>> >>> > >
