Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
top - 11:55:55 up 9 min,  5 users,  load average: 1.30, 1.55, 1.00
Tasks: 229 total,   2 running, 227 sleeping,   0 stopped,   0 zombie
Cpu(s): 12.6%us, 41.0%sy,  0.1%ni, 31.0%id, 12.9%wa,  0.0%hi,  2.4%si,  0.0%st
Mem:   1981596k total,  1003880k used,   977716k free,    65460k buffers
Swap:  4936696k total,    28500k used,  4908196k free,   341880k cached

PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                                                   
312 root      20   0   264   52   36 R  100  0.0  10:54.68 ipconfig -t 60 eth0

Can anyone please tell me why am I seeing the ipconfig command in top output which is taking 100% CPU?

ps aux|grep ipconfig

root       312 97.7  0.0    264    52 ?        R    11:46  12:13 ipconfig -t 60 eth0

How can I figure out which command is calling ipconfig? I am aware that there is no command called ipconfig in Linux.

How can I get more details about this process? This process appeared after rebooting system.

System: Ubuntu 10.04 LTS Desktop 64 bit

uname -a

Linux mc1 2.6.32-28-generic #55-Ubuntu SMP Mon Jan 10 23:42:43 UTC 2011 x86_64 GNU/Linux

lsof -p 312

COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
ipconfig 312 root  cwd    DIR    0,1        0    1 /
ipconfig 312 root  rtd    DIR    0,1        0    1 /
ipconfig 312 root  txt    REG    0,1    12088   69 /bin/ipconfig (deleted)
ipconfig 312 root  DEL    REG    0,1          1540 /lib/klibc- usBAintlt99f0TITo98H_trqH2c.so
ipconfig 312 root    0r   CHR    1,3      0t0  961 /dev/null
ipconfig 312 root    1u   CHR    5,1      0t0   11 /dev/console (deleted)
ipconfig 312 root    2u   CHR    5,1      0t0   11 /dev/console (deleted)
ipconfig 312 root    3u  sock    0,6      0t0 2216 can't identify protocol
ipconfig 312 root    4u  pack   2218      0t0   IP type=SOCK_DGRAM

strace -p 312 -r

  Process 312 attached - interrupt to quit
 0.000000 gettimeofday({1351147940, 178722}, NULL) = 0
 0.000064 recvfrom(4, "E\0\0<\35p@\0@\6\37J\177\0\0\1\177\0\0\1", 20, MSG_PEEK, {sa_family=AF_PACKET, proto=0x800, if1, pkttype=PACKET_HOST, addr(6)={772, 000000000000}, [18]) = 20
 0.000055 poll([{fd=4, events=POLLRDNORM}], 1, 19000) = 1 ([{fd=4, revents=POLLRDNORM}])
 0.000027 gettimeofday({1351147940, 178860}, NULL) = 0
 0.000019 recvfrom(4, "E\0\0<\35p@\0@\6\37J\177\0\0\1\177\0\0\1", 20, MSG_PEEK, {sa_family=AF_PACKET, proto=0x800, if1, pkttype=PACKET_HOST, addr(6)={772, 000000000000}, [18]) = 20
share|improve this question
1  
Run lsof -n -p 302 where the -p parameter is the pid. Add the output if it doesn't reveal an answer. –  Zoredache Oct 25 '12 at 6:46
    
So you will notice that /bin/ipconfig has been deleted. This either means you uninstalled the program without stopping it first, or if you don't recognize that at all, it makes me suspect your system may have been compromised. –  Zoredache Oct 25 '12 at 6:57
    
strace ouput is showing too many polling request and its not stopping... –  Kevin Parker Oct 25 '12 at 6:58
2  
Not sure what to tell you. I have never seen a command /bin/ipconfig, I can't find it on Google. I suspect it is bad left by a hacker, please refer to this question for how to respond if you agree that is the problem. Feel free wait for a second opinion though. –  Zoredache Oct 25 '12 at 7:05
1  
The term lan machine is meaningless. What matters is the firewall that protects your host/network, and the activities you have performed on the machine. –  Zoredache Oct 25 '12 at 7:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.