Check to see who (and from what IP) was the last to log into your machines (is the command also "last" under slack? 'not sure...). You could also look at /var/log/secure and /var/log/messages to see if anything odd has been happening over the past day or two. Garrett B_o_B wrote: >Friday, January 16, 2004 @ 9:17:44 PM Central Standard Time > >Hello, and a good day to you all. I run a couple slackware 9.1 boxes where >I work for our Internet related services. I like to use nmap to make >sure I am running only the services I need. While nmap'n both these >boxes today I noticed something I have not seen before. All of a >sudden both boxes are listing this: > >Port State Service >1720/tcp filtered H.323/Q.931 >also >690/tcp open unknown # this has also appeared on one of > # boxes. > >I'm kinda concerned. I have not introduced, or turned on any new >service. I did upgrade the kernel on both boxes to 2.4.24 since I last ran nmap I >think. Could the new kernel be doing something with this port 1720? >Or perhaps, someone it exploiting my machines? Hope not. >I can't figure out the 690 port either. > >here are the ip's of the boxes in question >64.122.144.195 >64.122.144.196 > >Any thoughts would be greatly appreciated to help solve my mystery. > >Many Thanks, > >Robert (aka B_o_B) David Felix De Mars >West Longitude 90' 15' 43" >http://b-o-b.homelinux.com > > >_______________________________________________ >TCLUG Mailing List - Minneapolis/St. Paul, Minnesota >http://www.mn-linux.org tclug-list at mn-linux.org >https://mailman.real-time.com/mailman/listinfo/tclug-list > > > _______________________________________________ TCLUG Mailing List - Minneapolis/St. Paul, Minnesota http://www.mn-linux.org tclug-list at mn-linux.org https://mailman.real-time.com/mailman/listinfo/tclug-list