johannes wrote:
Sarunas Burdulis wrote:The firewall (firestrarter gui to be precise), just shows a line in active connections (ie. NOT in blocked connections) with an 'unknown service' on port 1056 to that external host. I'm just wondering how firestarter knows about this connection. I don't know how to proceed. Maybe it's just a bug in firestarter to be ignored?What about `lsof -i`?nothing: llserv:~# lsof -i @217.91.13.234 llserv:~# lsof -i @213.20.165.177(I now have two of them, according to firestarter listening on different ports: 1054 and 33414)
Sorry to say but I'm as baffled as you are. If firestarter can see them listening then I don't see why netstat can't do so too. ethereal won't pick up anything if there's no traffic.
Why don't you block them in firestarter and see what stops working... ;)If you're really worried you could install and run chkrootkit to see if there's anything lurking on your machine that shouldn't be there but I'm sure you'll find nothing and that there's an innocent explanation for all this.
Sorry I can't help more.