This article might help too: http://www.ossec.net/dcid/?p=87
" If you ever had trouble with hidden ports on Linux (2.4 and 2.6), I may have figured out one of the possible causes today (and no, it is not a rootkit). To keep the story short: if you bind any TCP port, but do not listen on it, netstat will not show it at all (the same does not happen with UDP ports)... " Thanks, On Thu, Feb 17, 2011 at 4:22 PM, dan (ddp) <[email protected]> wrote: > You'll just have to track down what application is messing with the ports. > What do the servers do? > What processes do they run that are short lived and use ports in the > alerted ranges? > > On Wed, Feb 16, 2011 at 3:14 PM, Sebel, Gary M. <[email protected]> wrote: >> Dan >> >> It is the same each run on the system. How do you check to see if the port >> is open in solaris prior to doing the netstat. I ask because I have had >> another person confirm that they also see none of the ports reported as >> open. >> >> So from the runs on the 15th and the 16th the same set of ports are open >> in the 600/700 range. I am trying to test this out on another solaris >> server not running zones. >> >> Thanks >> -gary >> >> On 2/16/11 2:53 PM, "dan (ddp)" <[email protected]> wrote: >> >>>Hi Gary, >>>Is it always the same port? >>>OSSEC does 2 checks to see if a port is open, it tries to bind to the >>>port and checks netstat. If it cannot bind to the port, but netstat >>>does not see the port as open this alert will be triggered. >>>So if a process has a port open for the bind check, but closes the >>>port before the netstat check the alert will be triggered, but will be >>>a fale positive. >>> >>>I don't know enough about solaris w/zones to know if this fp scenario is >>>likely. >>> >>>On Wed, Feb 16, 2011 at 2:45 PM, Sebel, Gary M. <[email protected]> wrote: >>>> Hello >>>> >>>> I am testing OSSEC and have discovered that Solaris servers running with >>>> local zones are reporting odd messages: >>>> >>>> 2011 Feb 16 08:27:25 (first time detected: 2011 Feb 09 14:59:37) >>>> System Audit: Port '779'(tcp) hidden. Kernel-level rootkit or trojaned >>>> version of netstat. >>>> >>>> >>>> How is it finding the open ports and reporting on them? I read if it >>>>sees >>>> open ports and then notices that they are not open from a netstat it >>>>will >>>> report this error. Just not sure what command or script is reporting >>>> ports listening on what seems like closed ports. >>>> >>>> We have tested with netcat and nmap, confirmed with netstat and lsof >>>>that >>>> nothing listening on the port and verified this remotely all results >>>>show >>>> the port closed. >>>> >>>> Thanks >>>> -Gary >>>> >>>> >> >> >
