netstat -ap returned:
udp 0 0 *:3020 *:* 5805/named
lsof -i retuned:
named 5805 root 4u IPv4 14258216 UDP *:3020
It appears to be the named process and it has the same PID of the named
listening to the standard port. Any clue why it is listening to this
rotating port? I verified the RPM package with the rpm --verify
caching-nameserver-6.0-2 (from RH 6.1) and all I got back was:
S.5....T c /etc/named.conf
S.5....T c /var/named/named.local
which tells me that the named program itself isn't different. Is there a
possiblity that the named program is comprimised?
--Gavin
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Network Specialist - Lewis-Clark State College
V: 208-799-2215 F: 208-799-2842
Linux - Choice of a GNU Generation
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
Sent: Thursday, March 09, 2000 4:30 PM
To: [EMAIL PROTECTED]
Subject: RE: odd entry in netstat -a
On 10-Mar-2000 Gavin Budd wrote:
> I have an odd entry in netstat -a. It is an apparent random port that is
> listening for UDP packets. I haven't been able to find out what is
> listening to these ports. I don't have any unusual entries in my services
> or inetd.conf files and ps ax doesn't show anything unusual either. I
have
> verified the integrity of the ps file and it doesn't appear modified. Any
> suggestions on finding out what might be listening to this port?
>
> --Gavin Budd
Try:
netstat -ap | grep <port>
--
To unsubscribe: mail [EMAIL PROTECTED] with "unsubscribe"
as the Subject.
