From owner-freebsd-questions Mon Jun 22 11:10:33 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id LAA17671 for freebsd-questions-outgoing; Mon, 22 Jun 1998 11:10:33 -0700 (PDT) (envelope-from owner-freebsd-questions@FreeBSD.ORG) Received: from mercury.jorsm.com (mercury.jorsm.com [207.112.128.9]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id LAA17570 for ; Mon, 22 Jun 1998 11:10:04 -0700 (PDT) (envelope-from jer@jorsm.com) Received: from localhost (jer@localhost) by mercury.jorsm.com (8.8.7/8.8.7) with SMTP id NAA09837; Mon, 22 Jun 1998 13:10:01 -0500 (CDT) Date: Mon, 22 Jun 1998 13:10:00 -0500 (CDT) From: Jeremy Shaffner To: bush doctor cc: questions@FreeBSD.ORG Subject: Re: Looking for hackers with netstat In-Reply-To: <199806221533.LAA09743@ikhala.tcimet.net> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Mon, 22 Jun 1998, bush doctor wrote: > 3. command& # executed on remote host ... Because you put it in the background. > I notice that my processes no longer show up in w or who commands ... > is this one of the things hackers are doing to advoid detection. > Processes does still show up with a `ps -axl' > -===================================================================- Jeremy Shaffner JORSM Internet Senior Technical Support Northwest Indiana's Premium jer@jorsm.com Internet Service Provider support@jorsm.com http://www.jorsm.com -===================================================================- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message