[TriLUG] possible intruder - advice?

[Marty Ferguson]

Google "port 1025"

TCP Port 1025. Common Use. Microsoft Remote Procedure Call (RPC)
www.linklogger.com/TCP1025.htm 

Are you running Samba?

M

-----Original Message-----
From: trilug-bounces at trilug.org [mailto:trilug-bounces at trilug.org]On
Behalf Of Andrew Perrin
Sent: Monday, May 24, 2004 9:26 AM
To: trilug at trilug.org
Subject: [TriLUG] possible intruder - advice?


I"m showing someone attached to my home machine's port 1025. This is,
needless to say, not something I like.  fuser 1025/tcp and fuser 1025/udp
show nothing. 1025 isn't listed in /etc/services. What else should I look
at?

ap

----------------------------------------------------------------------
Andrew J Perrin - http://www.unc.edu/~aperrin
Assistant Professor of Sociology, U of North Carolina, Chapel Hill
clists at perrin.socsci.unc.edu * andrew_perrin (at) unc.edu

-- 
TriLUG mailing list        : http://www.trilug.org/mailman/listinfo/trilug
TriLUG Organizational FAQ  : http://trilug.org/faq/
TriLUG Member Services FAQ : http://members.trilug.org/services_faq/
TriLUG PGP Keyring         : http://trilug.org/~chrish/trilug.asc