Re: Compromised FBSD/Apache

[Adam Sampson <azz () gnu org>]

"Thomas C. Meggs" <tom () plik net> writes:

> Out of curiosity what is the Linux and Solaris equivalents for doing
> this?

With Linux net-tools, netstat has a -p option for this. "netstat
-nltp" will list listening TCP sockets and the processes that are
using them:

tcp        0      0 0.0.0.0:80        0.0.0.0:*   LISTEN    230/httpd    

I believe lsof can do the same sort of thing on both Linux and
Solaris (and a number of other systems).

-- 
Adam Sampson <azz () gnu org>                  <URL:http://azz.us-lot.org/>

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com