Re: Compromised FBSD/Apache

"Thomas C. Meggs" <tom@plik.net> writes:

> Out of curiosity what is the Linux and Solaris equivalents for doing
> this?

With Linux net-tools, netstat has a -p option for this. "netstat -nltp" will list listening TCP sockets and the processes that are using them:

tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 230/httpd

I believe lsof can do the same sort of thing on both Linux and Solaris (and a number of other systems).

-- 
Adam Sampson <
azz(at)gnu.org>                  http://azz.us-lot.org/>

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: 
http://aris.securityfocus.com