If you think it's a process, you might try
"top -q" or

#!/bin/ksh

while true ; do
    ps afxwww >>/var/tmp/psafxwww
done


and then hammer the crap out of yourself
(or pay a friend to do it to you) with
scans and (hopefully) see what process(es)
pop up in the table.


D

On Fri, 17 Mar 2000, der.hans wrote:

> Date: Fri, 17 Mar 2000 15:33:08 -0700 (MST)
> From: "der.hans" <PLUGd@LuftHans.com>
> Reply-To: plug-discuss@lists.PLUG.phoenix.az.us
> To: "'plug-discuss@lists.PLUG.phoenix.az.us'"
     <plug-discuss@lists.PLUG.phoenix.az.us>
> Subject: RE: port scanning
> 
> On Fri, 17 Mar 2000, Furmanek, Greg wrote:
> 
> > did you check /var/log/messages ??
> 
> Yup. Same with syslog, auth.log and all the other logs.
> 
> ciao,
> 
> der.hans
> -- 
> # +++++++++++=================================+++++++++++ #
> #  der.hans@LuftHans.com                  www.excelco.com #
> #            http://home.pages.de/~lufthans/              #
> #   I'm not anti-social, I'm pro-individual. - der.hans   #
> # ===========+++++++++++++++++++++++++++++++++=========== #
> 
> 
> _______________________________________________
> Plug-discuss mailing list  -  Plug-discuss@lists.PLUG.phoenix.az.us
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>