> I work for our Internet related services. I like to use nmap to make > sure I am running only the services I need. While nmap'n both these > boxes today I noticed something I have not seen before. The first thing I'd do is run a 'netstat -anp |grep LISTEN' on the box in question. If these ports don't show up in netstat, but they do in nmap, you probably have a trojaned copy of netstat, a good indication that unwelcomed things are living on your box. If they do show up, you'll be able to see which processes are opening these ports. Usually this jogs memories and you'll remember that weird thing you installed because package A depends on it. Good luck! -Brian _______________________________________________ TCLUG Mailing List - Minneapolis/St. Paul, Minnesota http://www.mn-linux.org tclug-list at mn-linux.org https://mailman.real-time.com/mailman/listinfo/tclug-list