Re: suspicious netstat ouput

[Adam Keys <akeys@mail.smu.edu>]

On 20 Apr 2001 18:26:00 -0400, Jonathan Freiermuth wrote:

> I got the following output from "netstat -elpn" on my firewall (kernel 2.4.2, iptables).
> 
> /-(root@cerberus)-(166/ttyS0)-(17:56:42:Friday Apr 20)- 
> \-(/var/log)- 
> ROOT : netstat -elpn
> Active Internet connections (only servers)
> Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name   
> tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      0          1229       427/sshd            
> tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      0          1542       487/sendmail: accep 
> udp        0      0 0.0.0.0:1112            0.0.0.0:*                           0          127022     16024/send-mail

I know little about sendmail, but if I was allowed to guess, I would say
it's just an ephermal connection between
sendmail and a client.  Following that, I would wonder why you are
running sendmail on a firewall? :)


-- 
,-----------------------------------------------------------------------------.
>                 Adam Keys                |                                  <
>            akeys@mail.smu.edu            |       Adam Keys Development      <
>               ICQ# 11772935              |             Ubercoder            <
>       http://mk.hotweird.com/~adam       |                                  <
,-----------------------------------------------------------------------------.
I wonder if I'm insecure, secure, secure about my insecurity, or secure about
covering up my insecurity.
`-----------------------------------------------------------------------------'