Hi,
PerfMeter gets it's info via RPC (Prog Num: 100001) from the rpc.rstatd
daemon (the daemon itself is launched via /etc/inetd.conf)
If there is any issue with the portmapper or connectivity to the rpc.statd
daemon then the tombstone appears AFAIK.
I'm not sure if PerfMeter first tries RPC then the "commonly known" port
for rstatd, but i guess that could be cleared up by stopping the
portmapper, and seeing if PerfMeter can still get information.
I fully agree with Paul however, it's definatley not a good idea to run RPC
on anything Internet accessible (even with a firewall, unless it has sane
Ingress rules).
Regards,
Chris.
At 11:30 PM 4/26/01 -0400, Paul D. Robertson wrote:
>On Fri, 27 Apr 2001 [EMAIL PROTECTED] wrote:
>
> > Greetings! I have a strange problem with sun netra i. It seems
> that
> > while running the performance meter application I got what looked like
> a
> > series tombstones with "R.I.P."written on them, for each item I
> am
> > monitoring. I am sending you this note because I wanted to find out
> if
> > this is related to any bugs/virus that you might know of and also I
> need
> > to know what to do to get rid of this problem. Please reply to
> this
> > email.
>
>
>http://aa11.cjb.net/sun_managers/2000/04/msg00216.html was the first
>reference I found searching on "netra tombstone." I have no idea as to
>its validity, as I'm not wanton enough to start up portmapper. If it were
>my box I'd try SunSolve if the man page doesn't say what's necessary.
>
>If it's an Internet facing box, make sure you've got portmapper filtered
>either at the gateway or on the box with IPFilter or Sunscreen. If it's
>an internal host make sure that you trust everything on the network or
>have it filtered. RPC's gotta be in the top two Solaris exploit vectors
>and if a google search isn't the first thing to come to mind with a
>problem like this, I doubt patches are near the top of the list...
>
>
>
>Paul
>-----------------------------------------------------------------------------
>Paul D. Robertson "My statements in this message are personal opinions
>[EMAIL PROTECTED] which may have no basis whatsoever in fact."
>
>-
>[To unsubscribe, send mail to [EMAIL PROTECTED] with
>"unsubscribe firewalls" in the body of the message.]
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
