0

I am assigned a server that has been sending tons of data ourside and isn't used. So, it is most likely compromised. Nothing really seems to be out of order on the server except, they're miles and miles of these DGRAM items in netstat.

unix  2      [ ]         DGRAM                    878377447 1165/java            
unix  2      [ ]         DGRAM                    773862304 1165/java            
unix  2      [ ]         DGRAM                    690302532 1165/java            
unix  2      [ ]         DGRAM                    223108186 1165/java            
unix  2      [ ]         DGRAM                    10318852 1165/java            
unix  2      [ ]         DGRAM                    4196896942 1165/java            
unix  2      [ ]         DGRAM                    3847577732 1165/java            
unix  2      [ ]         DGRAM                    3754238011 1165/java            
unix  2      [ ]         DGRAM                    3729499062 1165/java            
unix  2      [ ]         DGRAM                    3686466054 1165/java            
unix  2      [ ]         DGRAM                    3488420039 1165/java            
unix  2      [ ]         DGRAM                    3357838223 1165/java            
unix  2      [ ]         DGRAM                    3207591570 1165/java            
unix  2      [ ]         DGRAM                    3128277321 1165/java            
unix  2      [ ]         DGRAM                    3088626078 1165/java            
unix  2      [ ]         DGRAM                    2958537971 1165/java            
unix  2      [ ]         DGRAM                    2653604223 1165/java            
unix  2      [ ]         DGRAM                    2591912878 1165/java            
unix  2      [ ]         DGRAM                    2344638274 1165/java            
unix  2      [ ]         DGRAM                    2328447790 1165/java            
unix  2      [ ]         DGRAM                    2218612906 1165/java

Upon further investigation, the proces appears to be a zimbra mail process.

zimbra    1165  3.1  8.2 3717464 319584 ?      Sl   Sep22 1933:59 /opt/zimbra/common/lib/jvm/java/bin/java -XX:ErrorFile=/opt/zimbra/log -client -Xmx256m -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 -Djdk.tls.client.protocols=TLSv1,TLSv1.1,TLSv1.2 -Djava.net.preferIPv4Stack=true -Dzimbra.home=/opt/zimbra -Djava.library.path=/opt/zimbra/lib -Djava.ext.dirs=/opt/zimbra/common/lib/jvm/java/jre/lib/ext:/opt/zimbra/lib/jars:/opt/zimbra/lib/ext-common:/opt/zimbra/lib/ext/clamscanner:/opt/zimbra/lib/ext/zimbra-license:/opt/zimbra/lib/ext/twofactorauth:/opt/zimbra/lib/ext/com_zimbra_ssdb_ephemeral_store -Djava.io.tmpdir=/opt/zimbra/data/tmp -Dpython.cachedir.skip=true org.python.util.jython /opt/zimbra/libexec/zmconfigd

What are these and why are there so many? Can someone provide some insight for me on this?

Thanks

0

DGRAM stands for Datagram. This refers to connection-less protocols such as UDP.

UDP is the transport for DNS, so if Zimbra is resolving a lot of hostnames, it would show many entries here.

Bear in mind I don't know Zimbra and it could be doing something else.

  • I already know this. I was thinking there was more to this. – Qndel Nov 5 '17 at 5:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.