lsof, sockets and trojans

By Juliet Kemp (Send Email)
Posted Apr 27, 2009


When discussing lsof and open files a few weeks ago, I also mentioned that lsof -i will show you information about which IP sockets are open.

Tip of the Trade: lsof is a handy way to check for security problems or keep an eye on how your machines are interacting with the wider internet.

This can be useful in checking for security problems or just to keep an eye on how much your machines are interacting with the wider internet. Here's a little sample output:

COMMAND     PID        USER   FD   TYPE    DEVICE SIZE NODE NAME
dhclient   2242        root    6u  IPv4      6110       UDP *:bootpc 
cupsd      2928        root    1u  IPv4 260191390       TCP 
                                                   localhost:ipp (LISTEN)
mysqld     5763       mysql    4u  IPv4 187454609       TCP                         
        thisserver.example.com:38530->thatserver.example.com:ldaps (CLOSE_WAIT)
sshd      17005        root    3u  IPv6 264275196       TCP 
        thisserver.example.com:ssh->thatserver.example.com:53043 (ESTABLISHED)
You'll quite often see two reports from a single command, one for TCP and one for UDP. The PID and user is shown for each IP socket, so if you see something suspicious, you can investigate further (e.g., with ps -l 5763 to get more information on the mysql process here, or by looking at /proc/5763/).

For a real-time look at what's being opened where, try watch lsof -i (hit Ctrl-C to exit). To check out who's connecting to your web server, specify the port with lsof -i :80: You'll get a list that shows which IP addresses or hosts are looking at your web server right now. You can also check connections to a particular host with lsof -i@hostname.example.com (or give the IP address instead).

You can get similar information on which Unix sockets are open on your machine, with lsof -U. Unix sockets handle inter-process communication, a bit like IP sockets but within a single machine rather than across a network. This information can be useful when using strace to track down bugs.

Page 1 of 1


Comment and Contribute

Your name/nickname

Your email

(Maximum characters: 1200). You have characters left.