From owner-freebsd-questions@FreeBSD.ORG  Wed Apr 14 11:26:37 2004
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id C030716A4CE
	for <freebsd-questions@freebsd.org>;
	Wed, 14 Apr 2004 11:26:37 -0700 (PDT)
Received: from slacknet.slacknet.com (slacknet.slacknet.com [204.228.135.180])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 8F61E43D45
	for <freebsd-questions@freebsd.org>;
	Wed, 14 Apr 2004 11:26:37 -0700 (PDT)
	(envelope-from rj45@slacknet.com)
Received: from rj45 (helo=localhost)
	by slacknet.slacknet.com with local-esmtp (Exim 4.30 #1 (Debian))
	id 1BDp5p-0007kn-34; Wed, 14 Apr 2004 12:26:37 -0600
Date: Wed, 14 Apr 2004 12:26:37 -0600 (MDT)
From: RJ45 <rj45@slacknet.com>
To: Ion-Mihai Tetcu <itetcu@apropo.ro>
In-Reply-To: <20040413235143.4c2cb911@it.buh.cameradicommercio.ro>
Message-ID: <Pine.LNX.4.21.0404141225560.29551-100000@slacknet.slacknet.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-SA-Exim-Scanned: No; SAEximRunCond expanded to false
cc: freebsd-questions@freebsd.org
Subject: Re: portaudit
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 14 Apr 2004 18:26:37 -0000


hi,
actually I have many fetchaudit daily script running from previous days:

root    1310  0.0  0.1  1088  536  ??  I     6Apr04   0:00.02 /bin/sh
/usr/local/etc/periodic/daily/330.fetchaudit
root   68392  0.0  0.1  1088  536  ??  I     7Apr04   0:00.02 /bin/sh
/usr/local/etc/periodic/daily/330.fetchaudit
root   75805  0.0  0.1  1088  536  ??  I    Fri03AM   0:00.02 /bin/sh
/usr/local/etc/periodic/daily/330.fetchaudit
root   30120  0.0  0.1  1088  536  ??  I    Sat03AM   0:00.02 /bin/sh
/usr/local/etc/periodic/daily/330.fetchaudit
root   84915  0.0  0.1  1088  536  ??  I    Sun03AM   0:00.02 /bin/sh
/usr/local/etc/periodic/daily/330.fetchaudit

looks liek the traffic is due to this because I Stopped hte processes and
the traffic stopped as well...

thanks

Rick


On Tue, 13 Apr 2004, Ion-Mihai Tetcu wrote:

> On Tue, 13 Apr 2004 14:04:04 -0600 (MDT)
> RJ45 <rj45@slacknet.com> wrote:
> 
> > 
> > Hello,
> > I installed portaudit.
> > Since I installed it I noticed there are always ESTABLISHED connections to
> > some ftp servers:
> > 
> > tcp4       0     20  venus.51739            freebsd.utcluj.r.ftp
> > ESTABLISHED
> > tcp4       0     20  venus.49718            gort.ludd.ltu.se.ftp
> > ESTABLISHED
> > tcp4       0      6  venus.49706            www.freebsd.cz.ftp
> > ESTABLISHED
> > tcp4       0      6  venus.49688            gort.ludd.ltu.se.ftp
> > ESTABLISHED
> > tcp4       0     20  venus.49682            ftp.jpix.ad.jp.ftp
> > ESTABLISHED
> > 
> > and I noticed I have a constant traffic rate on my ADSL link of about
> > 20 Kb/sec inbound and 20 Kb/sec outbound, always day and night.
> > is it normal?
> 
> No. Edit /usr/local/etc/portaudit.conf and add something like:
> FETCH_BEFORE_ARGS=-vvv
> 
> after that do a ps and kill -9 the fetchaudit (or portaudit) process.
> 
> Watch your daily mail and send the output and the content of
> portaudit.conf.
> 
> But I doubt the the output traffic is portaudit fault.
> 
> -- 
> IOnut
> Unregistered ;) FreeBSD "user"
> 
>