Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

An LDAP server on another is reporting an unusually large number of attempts to read the LDAP directory, all of which look like hacking attempts to read user/password information. It reports that the originating IP is a Mac OS X server. I log into the Mac OS X server, run ps -A but it does nothing looks suspicious. Is there a way to see what the Mac OS X ldap client is doing?

I need to disable this malicious script, but I cannot disable the LDAP client completely, as users rely on this server for file storage and user ids.

share|improve this question

On the server: you can use tcpdump to sniff some packets from Mac OS X client:

# tcpdump -vv -s0 -i eth0 tcp port 389 and src host <mac.osx.ip.address>

and open with Wireshark to analyse.

On the client, use netstat to find out what process is connecting to LDAP server:

# netstat -natp | awk '$5 ~ /ldap.server.ip.address/ { print $0 }'
share|improve this answer
The Mac is OS X 10.4 (Tiger), and netstat's -p option is for specifying a protocol, not for listing a process. Is there another way to accomplish this? – John Oct 4 '11 at 15:48
sudo lsof -i:ldap will show you processes using port 389 (both in and out) on OS X 10.4. – Gordon Davisson Oct 4 '11 at 16:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.