Re: [newbie] Strange Activity

2004-05-24 Thread Stephen Kuhn
On Mon, 2004-05-24 at 17:48, Frank wrote: Checking `bindshell'... not infected Checking `lkm'... You have 2 process hidden for readdir command You have 2 process hidden for ps command Warning: Possible LKM Trojan installed Checking `rexedcs'... not found Er, have you RTFM the README

Re: [newbie] Strange Activity

2004-05-23 Thread Lyvim Xaphir
On Sat, 2004-05-22 at 15:18, Josenildo Marques wrote: On Sat, 2004-05-22 at 13:18, JoeHill wrote: ...betcha gotta be root to access eth0, most net traffic monitors I've used were like that. Absolutely right ! Thanks ! Nice twist in the right direction, Joe. :) LX

Re: [newbie] Strange Activity

2004-05-23 Thread JoeHill
On Sun, 23 May 2004 03:30:06 -0400 Lyvim Xaphir disseminated the following: ...betcha gotta be root to access eth0, most net traffic monitors I've used were like that. Absolutely right ! Thanks ! Nice twist in the right direction, Joe. :) Hey, even brainwashed socialist

Re: [newbie] Strange Activity

2004-05-23 Thread Lyvim Xaphir
On Sun, 2004-05-23 at 10:22, JoeHill wrote: On Sun, 23 May 2004 03:30:06 -0400 Lyvim Xaphir disseminated the following: ...betcha gotta be root to access eth0, most net traffic monitors I've used were like that. Absolutely right ! Thanks ! Nice twist in the right

Re: [newbie] Strange Activity

2004-05-23 Thread Richard Urwin
On Saturday 22 May 2004 8:18 pm, Josenildo Marques wrote: On Sat, 2004-05-22 at 13:18, JoeHill wrote: ...betcha gotta be root to access eth0, most net traffic monitors I've used were like that. Absolutely right ! Thanks ! If you're running 2.6 kernel there might be a better way by setting

Re: [newbie] Strange Activity

2004-05-22 Thread Greg
Even tho i run linux I still want to keep my guard upYou are right i do want to know whats coming in or trying to come in to my box is netwatch hard to set up and where do i get it thanks gregLyvim Xaphir [EMAIL PROTECTED] wrote: On Fri, 2004-05-21 at 01:37, Len Lawrence wrote: On

Re: [newbie] Strange Activity

2004-05-22 Thread Greg
Me too Thanks for the info You just have to love linux and this group Greg Kaj Haulrich [EMAIL PROTECTED] wrote: On Friday 21 May 2004 04:51, Lyvim Xaphir wrote: snip The thing to remember is that if you are on a workstation, you shouldn't need to run xinetd for the reasons listed. And

Re: [newbie] Strange Activity

2004-05-22 Thread Lyvim Xaphir
On Sat, 2004-05-22 at 02:29, Greg wrote: Me too Thanks for the info You just have to love linux and this group Greg Well, that's exactly why I post. Messages like this. Pretty much all the payment I need. :)) How about you, Kaj? You need any money? :) Kaj Haulrich [EMAIL

Re: [newbie] Strange Activity

2004-05-22 Thread Lyvim Xaphir
On Sat, 2004-05-22 at 02:25, Greg wrote: Even tho i run linux I still want to keep my guard up You are right i do want to know whats coming in or trying to come in to my box is netwatch hard to set up and where do i get it thanks greg

Re: [newbie] Strange Activity

2004-05-22 Thread Kaj Haulrich
On Saturday 22 May 2004 16:30, JoeHill wrote: On Sat, 22 May 2004 12:20:59 +0200 Kaj Haulrich disseminated the following: How about you, Kaj? You need any money? :) Sure, but if someone feels an obligation to pay a little dough, I suggest a donation to the Free Software Foundation :

Re: [newbie] Strange Activity

2004-05-22 Thread et
On Saturday 22 May 2004 10:54 am, Kaj Haulrich wrote: On Saturday 22 May 2004 16:30, JoeHill wrote: On Sat, 22 May 2004 12:20:59 +0200 Kaj Haulrich disseminated the following: How about you, Kaj? You need any money? :) Sure, but if someone feels an obligation to pay a little

Re: [newbie] Strange Activity

2004-05-22 Thread Josenildo Marques
On Sat, 2004-05-22 at 03:29, Greg wrote: Me too Thanks for the info You just have to love linux and this group Greg And I just have to second that !!! -- josenildo marques icq #289971493 homepage http://cyb.ezdir.net registered linux user #341648 * A televiso a maior maravilha

Re: [newbie] Strange Activity

2004-05-22 Thread Josenildo Marques
On Sat, 2004-05-22 at 05:57, Lyvim Xaphir wrote: On Sat, 2004-05-22 at 02:25, Greg wrote: Even tho i run linux I still want to keep my guard up You are right i do want to know whats coming in or trying to come in to my box is netwatch hard to set up and where do i get it thanks greg

Re: [newbie] Strange Activity

2004-05-22 Thread JoeHill
On Sat, 22 May 2004 11:35:14 -0400 et disseminated the following: I bought a Silver Club membership, does that count? Absolutely, Joe. Kaj Haulrich. Joe, when did you buy that membership? durring the first part of May? Can you check the account the funds were drawn on? Mandrake

Re: [newbie] Strange Activity

2004-05-22 Thread JoeHill
On Sat, 22 May 2004 12:46:10 -0300 Josenildo Marques disseminated the following: Took me awhile to find that. It was tough, I couldn't remember how I got it last time. It's the same version as the one on my system here, so although the site above does not disclose the version of Mandrake

Re: [newbie] Strange Activity

2004-05-22 Thread Chris
On Saturday 22 May 2004 03:57 am, Lyvim Xaphir wrote: On Sat, 2004-05-22 at 02:25, Greg wrote: Even tho i run linux I still want to keep my guard up You are right i do want to know whats coming in or trying to come in to my box is netwatch hard to set up and where do i get it thanks greg

Re: [newbie] Strange Activity

2004-05-22 Thread Lyvim Xaphir
On Sat, 2004-05-22 at 14:00, Chris wrote: On Saturday 22 May 2004 03:57 am, Lyvim Xaphir wrote: On Sat, 2004-05-22 at 02:25, Greg wrote: Even tho i run linux I still want to keep my guard up You are right i do want to know whats coming in or trying to come in to my box is netwatch hard

Re: [newbie] Strange Activity

2004-05-22 Thread Tom Brinkman
On Saturday 22 May 2004 05:20 am, Kaj Haulrich wrote: Sure, but if someone feels an obligation to pay a little dough, I suggest a donation to the Free Software Foundation : http://member.fsf.org/ Makes one sleep better, laugh louder and cry less. Kaj Haulrich. Been an associate member

Re: [newbie] Strange Activity

2004-05-22 Thread Josenildo Marques
On Sat, 2004-05-22 at 13:18, JoeHill wrote: ...betcha gotta be root to access eth0, most net traffic monitors I've used were like that. Absolutely right ! Thanks ! -- josenildo marques icq #289971493 homepage http://cyb.ezdir.net registered linux user #341648 * Well begun is half

Re: [newbie] Strange Activity

2004-05-22 Thread Chris
On Saturday 22 May 2004 01:33 pm, Lyvim Xaphir wrote: There was a new source file uploaded last night http://www.slctech.org/~mackay/netwatch-1.0bplay.tgz I was having problems installing the previous version, Gordon came up with a fix immediately. How's that for service? ;) Gordon

Re: [newbie] Strange Activity

2004-05-21 Thread Lyvim Xaphir
On Fri, 2004-05-21 at 00:13, Lanman wrote: Lyvim Xaphir wrote: My problem was corrected when I updated to the latest slew of updates and also replaced the secure kernel with the latest version. have not seen that problem since then. Lyvim; How ya doin' Buddy? I found another way to

Re: [newbie] Strange Activity

2004-05-21 Thread Lyvim Xaphir
On Fri, 2004-05-21 at 00:27, Greg wrote: Lyvim Xaphir [EMAIL PROTECTED] wrote: On Thu, 2004-05-20 at 23:23, Greg wrote: Is there any way to monitor network traffic Greg Yes, run netwatch on eth0. It beats netstat for monitoring connections. Netstat's place in the overall scheme of

Re: [newbie] Strange Activity

2004-05-21 Thread Kaj Haulrich
On Friday 21 May 2004 04:51, Lyvim Xaphir wrote: snip The thing to remember is that if you are on a workstation, you shouldn't need to run xinetd for the reasons listed. And if you *do* need to dynamically activate services, don't use xinetd to do that, use Dan Bernstein's Tcpserver

Re: [newbie] Strange Activity

2004-05-21 Thread Lyvim Xaphir
On Fri, 2004-05-21 at 01:37, Len Lawrence wrote: On Fri, 21 May 2004 00:27:33 -0400 [EMAIL PROTECTED] (Greg) wrote: Lyvim Xaphir [EMAIL PROTECTED] wrote: On Thu, 2004-05-20 at 23:23, Greg wrote: - snip - Is there any way to monitor network traffic Greg

[newbie] Strange Activity

2004-05-20 Thread Aron Smith
I have been getting a *Lot8 of disk activity around 7:00 am the output from dmesg looks something like this -Shorewall:net2all:DROP:IN=eth0 OUT= MAC=00:07:95:fc:2d:40:00:90:1a:40:aa:4d:08:00 SRC=24.202.47.169 DST=64.81.53.247

Re: [newbie] Strange Activity

2004-05-20 Thread Stephen Kuhn
On Fri, 2004-05-21 at 03:13, Aron Smith wrote: I have been getting a *Lot8 of disk activity around 7:00 am the output from dmesg looks something like this -Shorewall:net2all:DROP:IN=eth0 OUT=

Re: [newbie] Strange Activity

2004-05-20 Thread Aron Smith
On Thursday 20 May 2004 10:26 am, Stephen Kuhn wrote: On Fri, 2004-05-21 at 03:13, Aron Smith wrote: I have been getting a *Lot8 of disk activity around 7:00 am the output from dmesg looks something like this -Shorewal

Re: [newbie] Strange Activity

2004-05-20 Thread Asa Rossoff
Aron Smith [EMAIL PROTECTED] said: I have been getting a *Lot8 of disk activity around 7:00 am the output from dmesg looks something like this -Shorewall :net2all:DROP:IN=eth0 OUT= MAC=00:07:95:fc:2d:40:00:90:1a:40:aa:4d:08:00

Re: [newbie] Strange Activity

2004-05-20 Thread Aron Smith
On Thursday 20 May 2004 05:11 pm, Asa Rossoff wrote: Aron Smith [EMAIL PROTECTED] said: I have been getting a *Lot8 of disk activity around 7:00 am the output from dmesg looks something like this - Huge snip

Re: [newbie] Strange Activity

2004-05-20 Thread Greg
Lyvim Xaphir [EMAIL PROTECTED] wrote: On Thu, 2004-05-20 at 15:33, Aron Smith wrote: On Thursday 20 May 2004 12:02 pm, Lyvim Xaphir wrote: On Thu, 2004-05-20 at 13:13, Aron Smith wrote: I have been getting a *Lot8 of disk activity around 7:00 am the output from dmesg looks something

Re: [newbie] Strange Activity

2004-05-20 Thread Greg
Stephen Kuhn [EMAIL PROTECTED] wrote: On Fri, 2004-05-21 at 03:13, Aron Smith wrote: I have been getting a *Lot8 of disk activity around 7:00 am the output from dmesg looks something like this -Shorewall:net2all:DROP:IN=eth0

Re: [newbie] Strange Activity

2004-05-20 Thread Lanman
Asa Rossoff wrote: The log activity you posted doesn't indicate it. Those are all network packets that Shorewall dropped -- that didn't get in.. it's normal to have this activity, generated either by hackers checking for security holes or worms and whatnot. Asa On Mandrake 9.2, installed on a

Re: [newbie] Strange Activity

2004-05-20 Thread Lyvim Xaphir
On Thu, 2004-05-20 at 18:28, Kaj Haulrich wrote: Kaj, Excellent to hear from you again. On Thursday 20 May 2004 22:31, Aron Smith wrote: snip Not using NFS purwe linux systen rieserFS on some partitions how can I shut portmap off ? /snip You can stop portmap (or any service) by

Re: [newbie] Strange Activity

2004-05-20 Thread Lyvim Xaphir
On Thu, 2004-05-20 at 21:45, Greg wrote: Lyvim Xaphir [EMAIL PROTECTED] wrote: On Thu, 2004-05-20 at 15:33, Aron Smith wrote: On Thursday 20 May 2004 12:02 pm, Lyvim Xaphir wrote: On Thu, 2004-05-20 at 13:13, Aron Smith wrote: I have been getting a *Lot8 of disk activity around 7:00

Re: [newbie] Strange Activity

2004-05-20 Thread Greg
Lyvim Xaphir [EMAIL PROTECTED] wrote: On Thu, 2004-05-20 at 21:45, Greg wrote: Lyvim Xaphir [EMAIL PROTECTED] wrote: On Thu, 2004-05-20 at 15:33, Aron Smith wrote: On Thursday 20 May 2004 12:02 pm, Lyvim Xaphir wrote: On Thu, 2004-05-20 at 13:13, Aron Smith wrote: I have been getting

Re: [newbie] Strange Activity

2004-05-20 Thread Lyvim Xaphir
On Thu, 2004-05-20 at 22:23, Lanman wrote: Asa Rossoff wrote: The log activity you posted doesn't indicate it. Those are all network packets that Shorewall dropped -- that didn't get in.. it's normal to have this activity, generated either by hackers checking for security holes or

Re: [newbie] Strange Activity

2004-05-20 Thread Lyvim Xaphir
On Thu, 2004-05-20 at 23:23, Greg wrote: If you don't run NFS, shut it down on all runlevels. LX So how do I shut down all run levels and even know if they are running I did not see it in top Just what should be running for a basic linux box I may have some weak spots in my

Re: [newbie] Strange Activity

2004-05-20 Thread Lanman
Lyvim Xaphir wrote: My problem was corrected when I updated to the latest slew of updates and also replaced the secure kernel with the latest version. have not seen that problem since then. Lyvim; How ya doin' Buddy? I found another way to fix the problem. Can you say Bastille? Killed Shorewall,

Re: [newbie] Strange Activity

2004-05-20 Thread Greg
Lyvim Xaphir [EMAIL PROTECTED] wrote: On Thu, 2004-05-20 at 23:23, Greg wrote: If you don't run NFS, shut it down on all runlevels. LX So how do I shut down all run levels and even know if they are running I did not see it in top Just what should be running for a basic linux box

Re: [newbie] Strange Activity

2004-05-20 Thread Len Lawrence
On Fri, 21 May 2004 00:27:33 -0400 [EMAIL PROTECTED] (Greg) wrote: Lyvim Xaphir [EMAIL PROTECTED] wrote: On Thu, 2004-05-20 at 23:23, Greg wrote: - snip - Is there any way to monitor network traffic Greg You could try /usr/sbin/net_monitor. -- Len Lawrence