FirewallWizards
[Top] [All Lists]

Re: [fw-wiz] OT? New compromise.

To: "'Firewall Wizards Security Mailing List'" <firewall-wizards@listserv.cybertrust.com>
Subject: Re: [fw-wiz] OT? New compromise.
From: "Richard Golodner" <rgolodner@infratection.com>
Date: Wed, 28 Mar 2007 18:37:35 -0400
Delivered-to: sp-com-lists@consult.net
Delivered-to: fwwizards-list2@consult.net
Delivered-to: firewall-wizards@listserv.cybertrust.com
In-reply-to: <460AB2FA.7010400@infiltrated.net>
List-archive: <https://listserv.icsalabs.com/pipermail/firewall-wizards>
List-help: <mailto:firewall-wizards-request@listserv.icsalabs.com?subject=help>
List-id: Firewall Wizards Security Mailing List <firewall-wizards.listserv.icsalabs.com>
List-post: <mailto:firewall-wizards@listserv.icsalabs.com>
List-subscribe: <https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards>, <mailto:firewall-wizards-request@listserv.icsalabs.com?subject=subscribe>
List-unsubscribe: <https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards>, <mailto:firewall-wizards-request@listserv.icsalabs.com?subject=unsubscribe>
References: <1897E92A96C47648A6574CB9A51C64070229BAB8@SEBEV1PW.graybar.com> <460AB2FA.7010400@infiltrated.net>
Reply-to: Firewall Wizards Security Mailing List <firewall-wizards@listserv.icsalabs.com>
Sender: firewall-wizards-bounces@listserv.icsalabs.com
Thread-index: AcdxaTPs2szQkbUVQtmhOhfCEWvOvgAH+Kqw
    Whatever I/P stack you are using, I would start pumping some MSN I/M
packets around on my small subnet for this kind of thing. Mirroring a port
will give you the data and you can analyze with your favorite sniffer. See
what happens as the needed ports come alive and then timeout. It might give
you a better picture. 
Richard

-----Original Message-----
From: firewall-wizards-bounces@listserv.cybertrust.com
[mailto:firewall-wizards-bounces@listserv.cybertrust.com] On Behalf Of J.
Oquendo
Sent: Wednesday, March 28, 2007 2:25 PM
To: Firewall Wizards Security Mailing List
Cc: firewall-wizards@listserv.cybertrust.com
Subject: Re: [fw-wiz] OT? New compromise.

St John, Richard wrote:
>
> Once you determine there might be an issue, I think there used to be a
> program called openports which would run on the machine and relate any
> LISTENING or ESTABLISHED ports to the actual file that has the port
> open. This would then give you the service/process/program waiting for
> traffic on that port.
On Windows
/c:\netstat -an |find /i "listening"/

Why download when you can use existing tools...


Others...
#lsof|grep -i listen
#netstat -l|grep "*"
#netstat -a|grep -i listen (for Solaris ... at least 5.10)


-- 
====================================================
J. Oquendo
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743
sil . infiltrated @ net http://www.infiltrated.net 

The happiness of society is the end of government.
John Adams


_______________________________________________
firewall-wizards mailing list
firewall-wizards@listserv.icsalabs.com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

<Prev in Thread] Current Thread [Next in Thread>