Re: Yum install centos 5.2

[Mike Brandonisio <mbrando () jikometrix net>]

Hi Guy,

I'm getting closer. In using tshark to record all the SMTP traffic I was 
able to grep 'helo' and 'ehlo'. I got a hit on 'helo' where my server 
was saying it was a well known ISP. It is not. I then was able to cross 
reference the destination IP with the netstat log that showed that is 
was in fact php script. Now to find out which one. I have the PID but of 
course the script is not currently running.

Ant thoughts on how to track down the script?

Sincerely,
Mike
--
Mike Brandonisio          *    Web Hosting / Development
Tech One Illustration     *    Internet Marketing
tel (630) 759-9283 x1001  *    e-Commerce
mbrando () jikometrix net    *    www.jikometrix.net

   JIKOmetrix - Reliable web hosting



Guy Harris wrote:
> On Oct 12, 2009, at 6:33 AM, Mike Brandonisio wrote:
>
>   
> > Is it possible to include netstat as part of the trace with tshark?
> >     
>
> TShark doesn't include any code to fetch any "what process has a  
> socket bound to or connected to a given endpoint" information, so, no,  
> netstat information isn't part of a Wireshark/TShark trace (not that  
> there's any provision in pcap file format to store that anyway,  
> although pcap-NG could do that).
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>              mailto:wireshark-users-request () wireshark org?subject=unsubscribe
>
>

Attachment: mbrando.vcf
Description:

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe