I noticed my linux box seemed a bit slow today so I looked around and
found the following when I ran ps-fu root.
UID PID PPID C STIME TTY TIME CMD
root 1 0 2 02:51 ? 00:00:04 init
root 2 1 0 02:51 ? 00:00:00 [keventd]
root 3 1 0 02:51 ? 00:00:00 [ksoftirqd_CPU0]
root 4 1 0 02:51 ? 00:00:00 [kswapd]
root 5 1 0 02:51 ? 00:00:00 [bdflush]
root 6 1 0 02:51 ? 00:00:00 [kupdated]
root 10 1 0 02:52 ? 00:00:00 [mdrecoveryd]
root 11 1 0 02:52 ? 00:00:00 [kjournald]
root 26 1 0 02:52 ? 00:00:00 [loop0]
root 161 1 0 02:52 ? 00:00:00 [eth0]
root 214 1 0 02:52 ? 00:00:00 [khubd]
root 741 1 0 02:52 ? 00:00:00 /usr/sbin/syslogd
root 744 1 0 02:52 ? 00:00:00 /usr/sbin/klogd -c 3 -x
root 747 1 0 02:52 ? 00:00:00 /usr/sbin/inetd
root 750 1 1 02:52 ? 00:00:01 /usr/sbin/sshd
root 760 1 0 02:52 ? 00:00:00 /usr/sbin/crond -l10
root 763 1 0 02:52 ? 00:00:00 sendmail: accepting connections
root 773 1 0 02:52 ? 00:00:00 /usr/sbin/httpd
root 775 1 0 02:52 ? 00:00:00 /usr/sbin/gpm -m /dev/mouse -t i
root 778 1 0 02:52 ? 00:00:00 [eth1]
root 802 1 0 02:52 ? 00:00:00 smbd
root 804 1 0 02:52 ? 00:00:00 nmbd
root 805 804 0 02:52 ? 00:00:00 nmbd
root 808 1 0 02:52 tty2 00:00:00 /sbin/agetty 38400 tty2 linux
root 809 1 0 02:52 tty3 00:00:00 /sbin/agetty 38400 tty3 linux
root 810 1 0 02:52 tty4 00:00:00 /sbin/agetty 38400 tty4 linux
root 811 1 0 02:52 tty5 00:00:00 /sbin/agetty 38400 tty5 linux
root 812 1 0 02:52 tty6 00:00:00 /sbin/agetty 38400 tty6 linux
root 813 802 0 02:53 ? 00:00:00 smbd
I ran ftpwho and it showed only one ftp login. I then ran netwatch and it
showed two connections from different IP addresses. I then ran tcpdump
and it showed the follwing which got my attention.
03:14:36.904761 216-19-216-108.getnet.net.1041 > dsl-082-082-166-008.arcor-ip.net.3352: . 40961:42373(1412) ack 0 win 5840 (DF)
03:14:47.336196 216-19-216-108.getnet.net.1040 > dialin-212-144-039-232.arcor-ip.net.blackjack: P 105985:106497(512) ack 0 win 5840 (DF)
What is this blackjack? Will someone please let me know what kind of
threat this is if any? If it is a threat, what do I do about it?
Thanks
Jim
---------------------------------------------------
PLUG-discuss mailing list -
PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change you mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
(text/plain)