[lug] hung port

[Kevin Fenzi]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

>>>>> "Duncan" == Duncan McGreggor <duncan at adytumsolutions.com> writes:

Duncan> On Oct 19, 2004, at 3:44 PM, dan radom wrote:

>> * Duncan McGreggor (duncan at adytumsolutions.com) wrote:
>>> Hey all,
>>> 
>>> I've got a linux server that runs apache. The apache process is
>>> now dead, but tcp port 80 is still listening. To confirm there is
>>> no process associated with this I have done the following:
>>> 
>>> netstat -pn|grep 80 lsof -i|grep http
>>> 
>> does fuser 80/tcp return anything when ran as root?

Duncan> Sorry, I meant to mention that one too -- no, fuser didn't
Duncan> return anything. Which is not surprising, given that there was
Duncan> nothing in lsof listed as listening on 80 (and, incidentally,
Duncan> there were no apache/http files listed in the full output of
Duncan> an lsof command).

fuser -n tcp 80 
?

If that doesn't return anything then I would suggest you try running
chkrootkit: http://www.chkrootkit.org/
or 
rootkit hunter: http://www.rootkit.nl/

and see if your machine has been compromised. 

Duncan> d

kevin
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Processed by Mailcrypt 3.5.8 <http://mailcrypt.sourceforge.net/>

iD8DBQFBdY7o3imCezTjY0ERApW7AKCHMDRqR6MtUoJvaY+HLiAYKHnaIwCgiRgR
p/RLGPqSnarBzBYxvBjIp/k=
=Snii
-----END PGP SIGNATURE-----