On Aug 27, 11:11 am, "Peter M. Abraham" <[EMAIL PROTECTED]> wrote: > Greetings: > > I replaced the netstat on the server (actually updated net-tools which > was out dated), > > rpm -V net-tools-1.60-37.EL4.9 > > Provides no output for which I understand means the package verified > ok.
You realize that even though the netstat package is ok, that your c library, or worse, your kernel could have been patched with a rootkitted version, right? If the box has been compromised with an advanced rootkit, it might also patch the rpm command. Your best bet would be to bring the system down, boot it up with a live cd, and check the md5sums of said binaries. Perhaps running something like chkrootkit or rkhunter also. Just a few thoughts that might or might not help.
