From owner-freebsd-questions@FreeBSD.ORG Mon Dec 27 14:58:16 2010 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 165C810656C5 for ; Mon, 27 Dec 2010 14:58:16 +0000 (UTC) (envelope-from mike@sentex.net) Received: from smarthost1.sentex.ca (smarthost1-6.sentex.ca [IPv6:2607:f3e0:0:1::12]) by mx1.freebsd.org (Postfix) with ESMTP id C57028FC23 for ; Mon, 27 Dec 2010 14:58:15 +0000 (UTC) Received: from [IPv6:2607:f3e0:0:4:5570:ff31:c40c:8eac] ([IPv6:2607:f3e0:0:4:5570:ff31:c40c:8eac]) by smarthost1.sentex.ca (8.14.4/8.14.4) with ESMTP id oBREwD8q053329 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO); Mon, 27 Dec 2010 09:58:13 -0500 (EST) (envelope-from mike@sentex.net) Message-ID: <4D18A982.4020006@sentex.net> Date: Mon, 27 Dec 2010 09:58:10 -0500 From: Mike Tancsa User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101207 Thunderbird/3.1.7 MIME-Version: 1.0 To: S Mathias References: <586011.29943.qm@web121407.mail.ne1.yahoo.com> In-Reply-To: <586011.29943.qm@web121407.mail.ne1.yahoo.com> X-Enigmail-Version: 1.1.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.67 on IPv6:2607:f3e0:0:1::12 Cc: freebsd-questions@freebsd.org Subject: Re: what process is sending this packet? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Dec 2010 14:58:16 -0000 On 12/27/2010 9:30 AM, S Mathias wrote: > I can see, that theres a program that keeps sending packets on port 25: > > Dec 27 14:11:46 a kernel: [ 6336.992320] O_D_LOG: IN= OUT=lo SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=61533 DF PROTO=TCP SPT=37263 DPT=25 WINDOW=32792 RES=0x00 SYN URGP=0 > Dec 27 14:12:01 a kernel: [ 6352.635704] O_D_LOG: IN= OUT=lo SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=55853 DF PROTO=TCP SPT=40644 DPT=25 WINDOW=32792 RES=0x00 SYN URGP=0 > Dec 27 14:12:04 a kernel: [ 6355.641085] O_D_LOG: IN= OUT=lo SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=55854 DF PROTO=TCP SPT=40644 DPT=25 WINDOW=32792 RES=0x00 SYN URGP=0 > Dec 27 14:12:10 a kernel: [ 6361.649059] O_D_LOG: IN= OUT=lo SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=55855 DF PROTO=TCP SPT=40644 DPT=25 WINDOW=32792 RES=0x00 SYN URGP=0 > > but where or how could i find out, that what process sends these packets? On FreeBSD, take a look at the audit subsystem http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/audit.html ---Mike