How to see Mac OS X scripts running?

Question

An LDAP server on another is reporting an unusually large number of attempts to read the LDAP directory, all of which look like hacking attempts to read user/password information. It reports that the originating IP is a Mac OS X server. I log into the Mac OS X server, run ps -A but it does nothing looks suspicious. Is there a way to see what the Mac OS X ldap client is doing?

I need to disable this malicious script, but I cannot disable the LDAP client completely, as users rely on this server for file storage and user ids.

Answer 1

On the server: you can use tcpdump to sniff some packets from Mac OS X client:

# tcpdump -vv -s0 -i eth0 tcp port 389 and src host <mac.osx.ip.address>

and open with Wireshark to analyse.

On the client, use netstat to find out what process is connecting to LDAP server:

# netstat -natp | awk '$5 ~ /ldap.server.ip.address/ { print $0 }'