Re: Strange connection attempts
On 9/15/06, Graham Smith <graham@crazysquirrel.com> wrote:
I run Bind and I was wondering if that might be the cause. I've just
grepped through the whole of etc looking for 5353 and come up empty.
I've also tried netstat -l to no avail.
Oops, I missed the fact that 192.168.0.1 in the SRC field was your
internal interface, so if I'm not mistaken some process on your server
is sending multicast packets through that interface. The -l switch
returns listening sockets, am I right? Did you try the -p switch while
grepping for the SRC port, which is 56190, but this is likely to
change between connections. I think netstat -nap | grep 5353 is
probably a better bet. But if the connections are being made at random
times this might be a bit tricky. Maybe you can write a script to take
samples and see if it pops up.
Hope this helps.
--
Anuradha Weeraman
http://www.linux.lk/~anu/
http://anuradha.wordpress.com
Reply to: