From owner-freebsd-questions@FreeBSD.ORG Wed Jun 8 04:28:01 2005 Return-Path: X-Original-To: questions@freebsd.org Delivered-To: freebsd-questions@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3AAF016A41C for ; Wed, 8 Jun 2005 04:28:01 +0000 (GMT) (envelope-from kalin@el.net) Received: from mail.el.net (mail.el.net [68.165.89.90]) by mx1.FreeBSD.org (Postfix) with ESMTP id BF3BE43D1D for ; Wed, 8 Jun 2005 04:28:00 +0000 (GMT) (envelope-from kalin@el.net) Received: (qmail 26363 invoked by uid 1008); 8 Jun 2005 04:29:57 -0000 Received: from unknown (HELO mail.el.net) (127.0.0.1) by mail.el.net with SMTP; 8 Jun 2005 04:29:57 -0000 Received: from 68.165.89.73 (SquirrelMail authenticated user kalin@el.net); by mail.el.net with HTTP; Wed, 8 Jun 2005 00:29:57 -0400 (EDT) Message-ID: <59298.68.165.89.73.1118204997.squirrel@68.165.89.73> In-Reply-To: <20050607222655.B23064@mail.goinet.com> References: <59030.68.165.89.73.1118200333.squirrel@68.165.89.73> <42A66509.4070709@ibsd.us> <20050607222655.B23064@mail.goinet.com> Date: Wed, 8 Jun 2005 00:29:57 -0400 (EDT) From: "kalin mintchev" To: "Tony Shadwick" User-Agent: SquirrelMail/1.4.3a X-Mailer: SquirrelMail/1.4.3a MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal Cc: Bob Bomar , questions@freebsd.org Subject: Re: ircd X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Jun 2005 04:28:01 -0000 i did run chkrootkit before writing this... nothing. and nothing on nmap about those ports!?!.... thanks... # chkrootkit -V chkrootkit version 0.44 > I concur. You might also want to run chkrootkit (security/chkrootkit) to > see if you've been "0wned" so to speak. > > On Tue, 7 Jun 2005, Bob Bomar wrote: > >> kalin mintchev wrote: >> | >> | hi all... >> | >> | i found this 2 lines in the netstat output on one of my machines. we >> are >> | not running ircd and according to nmap ports 3483 and 2143 are >> closed... >> | >> | can somebody please explain?? thanks..... >> | >> | tcp4 0 0 server.3484 zagreb.hr.eu.und.ircd >> | ESTABLISHED >> | tcp4 0 0 server.2143 free.tyranz.com.ircd >> | ESTABLISHED >> >> Are you running any kind of irc client? The output means: >> >> There are 2 connections, one on port 3484, and another on 2143 >> connected to zagreb.hr.eu.und and free.tyranz.com on the port >> for ircd, port 6667. >> >> Some trojens use irc channels for control, might look into that. >> >> -- >> Bob Bomar >> bob@bomar.us >> http://www.bomar.us/~bob >> _______________________________________________ >> freebsd-questions@freebsd.org mailing list >> http://lists.freebsd.org/mailman/listinfo/freebsd-questions >> To unsubscribe, send any mail to >> "freebsd-questions-unsubscribe@freebsd.org" >> ------------ Output from gpg ------------ >> gpg: Signature made Tue Jun 7 22:24:55 2005 CDT using DSA key ID >> 3AED74AA >> gpg: Can't check signature: public key not found >> >> > -- -- "In a world without walls or fences, who needs Windows and Gates?"