John,
This FAQ may prove helpful: http://www.robertgraham.com/pubs/firewall-seen.html
sysstat port 11
| This is a UNIX service that will list all the running processes on a machine and who started them. This gives an intruder a huge amount of information that might be used to compromise the machine, such as indicating programs with known vulnerabilities or user accounts. It is similar the contents that can be displayed with the UNIX "ps" command. ICMP doesn't have ports; if you see something that says "ICMP port 11", you probably want ICMP type=11 |
-- Bill Stackpole, CISSP
