Re: Open Ports and Trojan Horses

["Russell W. Behne" <russ behne penguinpowered com>]

On Tue, 1 Feb 2000, Hal Burgiss wrote:
> On Tue, Feb 01, 2000 at 03:15:13PM -0500, Steve wrote:
> > When I do a netstat -a I get a whole list of ports that are open on
> > my box but some of them are not listed in /etc/services and accoring
> > to a security doc one is used by netbus (12345) How do I check to
> > see what ports are allocated to what services and if I do have
> > netbus on my box how do I get rid of it?
> 
> Are you running portsentry by any chance?
>  [hal feenix hal]$ sudo netstat -ap | grep 12345
>  tcp      0      0 *:12345         *:*     LISTEN      556/portsentry 
> If you are, some ports appear open because portsentry is lurking
> there. Not to worry if that be the case.

I just did the same and found this:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 209.122.212.60:1351     209.90.19.4:2345 ESTABLISHED
tcp       57      0 209.122.212.60:1305     18.69.0.41:ftp CLOSE_WAIT

What do you make of that?

Mit freundlichen Grüßen,
Russ.
                Ne Desit Virtus - The Behne Family Motto

It takes two to tell the truth: one to speak and one to hear.