If my netstat started acting strangely, especially on more than one machine, I would definitely assume I got hacked. Try using chkrootkit. Like Bill said, you may have to boot from a boot cd to detect them. I think there's a security version of knoppix that has stuff to investigate boxes, you might try that. -jay On Oct 21, 2003, at 11:29 PM, Bob Tanner wrote: > On Tuesday 21 October 2003 09:18 pm, Michael D. Cassano wrote: >> All of a sudden three of my linux machines that are connected to the >> Internet are getting very wierd on me. >> >> SSH works, apache works, sendmail doesn't work, named doesn't work. >> >> All I can say is that when I do netstat -tua I get "Segmentation >> Fault". >> >> Any clue here? >> >> Mike > > Did you check for rootkits? > > If it's a good kit, you'll have to boot from something like a bbc and > run it > that way, cuz the'll have kernel mods in that will prevent rootkit from > running appropriately. > > -- > Bob Tanner <tanner at mn-linux.org> | Phone : (952)943-8700 > http://www.mn-linux.org, Minnesota, Linux | Fax : (952)943-8500 > Key fingerprint = AB15 0BDF BCDE 4369 5B42 1973 7CF1 A709 2CC1 B288 > > _______________________________________________ > TCLUG Mailing List - Minneapolis/St. Paul, Minnesota > http://www.mn-linux.org tclug-list at mn-linux.org > https://mailman.real-time.com/mailman/listinfo/tclug-list _______________________________________________ TCLUG Mailing List - Minneapolis/St. Paul, Minnesota http://www.mn-linux.org tclug-list at mn-linux.org https://mailman.real-time.com/mailman/listinfo/tclug-list