Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have Linux server running a unauthorized process (which I do not know the name of) which is doing a port scan from the server out to the internet.

How do I find out which process this is and kill it!

Thanks!

share|improve this question

3 Answers 3

up vote 2 down vote accepted

Look at the lsof output and track down the process that is opening a large number of possibly sequential port numbers.

share|improve this answer
2  
If course that is assuming that lsof or the kernel hasn't been patched by the unauthorized process so it won't be displayed. –  Zoredache Mar 19 '10 at 18:26
    
Yeah, that's exactly correct. If it turns out to be a rooted machine, you can always try a fresh install of lsof or rebooting into a "known good" kernel. But at that point, your best bet is usually the installation CD and a late night. –  McJeff Mar 19 '10 at 18:28
1  
The syntax should be lsof -i or netstat -anp –  Mircea Vutcovici Mar 19 '10 at 18:55

If your system has been compromised there may be no possible way to identify and kill the process. Your only recourse may be to restart the machine from clean media and start your a scan/restore/rebuild.

See: Aftermath of a hack

share|improve this answer

netstat -l -p -d may give interesting result if the machine is not rootkitted.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.