{"id":277,"date":"2011-10-13T16:31:46","date_gmt":"2011-10-13T20:31:46","guid":{"rendered":"http:\/\/blogs.law.harvard.edu\/djcp\/?p=277"},"modified":"2011-10-13T16:34:44","modified_gmt":"2011-10-13T20:34:44","slug":"figuring-out-whats-behind-a-listening-process-without-a-program-pid","status":"publish","type":"post","link":"https:\/\/archive.blogs.harvard.edu\/djcp\/2011\/10\/figuring-out-whats-behind-a-listening-process-without-a-program-pid\/","title":{"rendered":"Figuring out what’s behind a listening process without a program \/ pid."},"content":{"rendered":"

Say you’re being a good sysadmin and you’re checking out listeners on your machines:<\/p>\n

\r\nroot@deathstar:~# netstat -pant | grep LISTEN\r\ntcp        0      0 127.0.0.1:873           0.0.0.0:*               LISTEN      3947\/rsync      \r\ntcp        0      0 0.0.0.0:8649            0.0.0.0:*               LISTEN      3826\/gmond      \r\ntcp        0      0 192.168.10.122:9102     0.0.0.0:*               LISTEN      4167\/bacula-fd  \r\ntcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      3229\/portmap    \r\ntcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      3468\/sshd       \r\ntcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      3930\/master     \r\ntcp        0      0 0.0.0.0:44572           0.0.0.0:*               LISTEN      -               \r\ntcp        0      0 0.0.0.0:34271           0.0.0.0:*               LISTEN      3247\/rpc.statd  \r\ntcp6       0      0 :::22                   :::*                    LISTEN      3468\/sshd       \r\n<\/pre>\n
lolwut is listening on 44572 ?<\/p>\n
\r\n lsof -i -n -P | grep 44572\r\n<\/pre>\n
returns nothing! IT MUST BE A ROOTKIT!!eleventy!!! <\/p>\n
Wait – maybe portmapper has assigned it to a kernel-level server?<\/p>\n
\r\nroot@deathstar:~# pmap_dump\r\n    100000    2   tcp    111  portmapper\r\n    100000    2   udp    111  portmapper\r\n    100024    1   udp  44915  status\r\n    100024    1   tcp  34271  status\r\n    100021    1   tcp  44572  nlockmgr\r\n    100021    3   tcp  44572  nlockmgr\r\n    100021    4   tcp  44572  nlockmgr\r\n<\/pre>\n
Whew- it’s nlockmgr, part of nfs file locking. <\/p>\n
So the moral of the story – just because netstat can’t determine a program or pid doesn’t mean you’re in trouble. Check portmapper’s assignments via pmap_dump first, as it might be innocuous.   <\/p>\n
Apparently netstat can be made aware of portmapper assignments, but it doesn’t appear it is aware of kernel level services – or – it just doesn’t work for me.<\/p>\n","protected":false},"excerpt":{"rendered":"
Say you’re being a good sysadmin and you’re checking out listeners on your machines: root@deathstar:~# netstat -pant | grep LISTEN tcp 0 0 127.0.0.1:873 0.0.0.0:* LISTEN 3947\/rsync tcp 0 0 0.0.0.0:8649 0.0.0.0:* LISTEN 3826\/gmond tcp 0 0 192.168.10.122:9102 0.0.0.0:* LISTEN … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1984,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[17297,1100,593,4115],"class_list":["post-277","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-debian","tag-linux","tag-security","tag-sysadmin"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/archive.blogs.harvard.edu\/djcp\/wp-json\/wp\/v2\/posts\/277","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/archive.blogs.harvard.edu\/djcp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/archive.blogs.harvard.edu\/djcp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/djcp\/wp-json\/wp\/v2\/users\/1984"}],"replies":[{"embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/djcp\/wp-json\/wp\/v2\/comments?post=277"}],"version-history":[{"count":4,"href":"https:\/\/archive.blogs.harvard.edu\/djcp\/wp-json\/wp\/v2\/posts\/277\/revisions"}],"predecessor-version":[{"id":281,"href":"https:\/\/archive.blogs.harvard.edu\/djcp\/wp-json\/wp\/v2\/posts\/277\/revisions\/281"}],"wp:attachment":[{"href":"https:\/\/archive.blogs.harvard.edu\/djcp\/wp-json\/wp\/v2\/media?parent=277"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/djcp\/wp-json\/wp\/v2\/categories?post=277"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/djcp\/wp-json\/wp\/v2\/tags?post=277"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}