LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 11-05-2012, 06:35 PM   #1
waddles
Member
 
Registered: Sep 2012
Posts: 372

Rep: Reputation: 1
Learning about IDS


I wanted to learn more about how Intrusion Detection worked so I searched for "How to write IDS in bash".
I found that netstat -an | grep LISTEN | grep <port number> would find ports in use by testing on the returned response ($?). But this also returns about a dozen of lines like:
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 6220 /tmp/ssh-qUrvMutm1987/agent.1987

But the I-node numeric sequence is irregular which puzzles me??
Is an I-node not a port number?? Confused!
If ACC means waiting for a connection does that also imply the port is in service and waiting for a specific external input??
Perhaps someone can clarify for me please and thanks.
 
Old 11-05-2012, 06:41 PM   #2
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.8, Centos 5.10
Posts: 17,240

Rep: Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324
You should read the netstat man page. There are many protocols that could be used.
In normal usage, its usually either tcp or udp or unix sockets.

http://linux.die.net/man/8/netstat
 
Old 11-05-2012, 07:12 PM   #3
waddles
Member
 
Registered: Sep 2012
Posts: 372

Original Poster
Rep: Reputation: 1
Learning about IDS

Thanx 4 the url. I had blindly used the netstat line as it had been presented. Even in my man page the distinction of Connect, Waiting for, and Disconnect was not as obvious. Sometimes the man page is far too specific and lacks sufficient explanation unless one is totally awash with the subject.

I still don't understand why the I-nodes are not numerically sequenced?
Regarding the protocols; I would think that is not useful here since I want the state of the port and a port cannot as far as I know be connected in multiple protocols simultaneously only sequentially if that.
In fact I am not sure why I am getting this dozen or so since the last grep specifies a particular port which is not any of the I-nodes shown tho it was not necessary to list all of them. Thanks tho 4 the url again
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] RHCSA learning... RHEL6 or CENT OS for learning shejin983 Linux - Server 4 10-27-2012 10:16 AM
E-learning learning, VLS want to help other learn? scheidel21 General 0 04-06-2010 12:19 PM
Ids SBN Linux - Security 1 03-11-2007 11:49 PM
adding pci device ids to pci.ids xerxex Linux - General 0 01-18-2006 07:36 PM
Ids? zuessh Linux - Security 9 04-26-2003 06:48 AM


All times are GMT -5. The time now is 09:01 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration