Dave, I participate in a local Linux User Group. Here is a message from that group. This is FYI only in case you are interested.
Mike On Friday 26 September 2003 14:56, Errol Casey wrote: > This is on a box that has been root kited (sucKIT) and will be > reinstalled, but was wondering what this raw > connection is? > > raw 0 0 0.0.0.0:6 0.0.0.0:* 7 > - > raw 0 0 0.0.0.0:1 0.0.0.0:* 7 > - > raw 0 0 0.0.0.0:6 0.0.0.0:* 7 > - > > > Anybody know how the backdoor works on this root kit? -- TriLUG mailing list : http://www.trilug.org/mailman/listinfo/trilug TriLUG Organizational FAQ : http://trilug.org/faq/ TriLUG Member Services FAQ : http://members.trilug.org/services_faq/ TriLUG PGP Keyring : http://trilug.org/~chrish/trilug.asc
