Re: My machine is sending out ssh port scans.

From: Andrew Schulman (andrex_at_deadspam.com)
Date: 01/07/05


Date: Fri, 7 Jan 2005 10:37:29 -0500


> My machine is doing an SSH port scan of all machines on my network.
> I tried to see of any rootkit was installed.. but chkrootkit did not
> anything..

As root, run 'netstat -anp -A inet | grep :22', assuming that the
scanning process is looking for ssh servers on port 22. This will show
you the names and process IDs of processes that are opening connections
to port 22.

-- 
To reply by email, replace "deadspam.com" by "alumni.utexas.net"


Relevant Pages

  • Re: Ive been hacked, found mldonkey running
    ... I had an open FTP port which I normally keep closed but I ... The machine that was compromised with mldonkey is running ... Is it possible to get through an ssh port if RSA ...
    (comp.os.linux.security)
  • Re: SSH
    ... I changed my SSH port from 22 to something else. ... But from the new Linux box I cannot ping my Windows box OR even ...
    (comp.os.linux.misc)
  • Re: SSH
    ... I changed my SSH port from 22 to something else. ... box.....from the new Linux box I can ping my older Linux box. ... Windows system, you either need the DNS service set up and resolving ...
    (comp.os.linux.misc)
  • Re: SSH
    ... I changed my SSH port from 22 to something else. ... box.....from the new Linux box I can ping my older Linux box. ... Windows system, you either need the DNS service set up and resolving ...
    (comp.os.linux.misc)
  • Re: SSH Cracking Attempts
    ... about protecting your computer using a port knocking system. ... remember correctly, you can close a port (your SSH port, for example) ... IP-adress that performed the knocking sequence. ...
    (Debian-User)