Bots without PID's, how to kill em?

genderbender · 05-23-2007, 06:28 PM

I've got nagios monitoring my servers but every now and again nagios reports outbound connections to weird hosts on port 6667, I've typically found that this is an IRC bot port. If theres no PID how can you kill the connection?

Someone said lsof -i and then the port should help me out but I havent managed to get that to work. Any ideas anyone? ps installng new software is not possible.

Thanks for the help

Quakeboy02 · 05-23-2007, 06:32 PM

Are you sure a bandaid is enough? Is this a sign that your systems are compromised? If so, it can only go downhill from here.

twantrd · 05-23-2007, 08:18 PM

lsof -i:6667 or netstat -pan | grep 6667 will tell you the answer. Perhaps you don't see it because the program establishes a connections and closes it fairly quick.

But yes, I agree with quakeboy. You should know what's going on with your systems and what they have.

-twantrd

genderbender · 05-23-2007, 09:35 PM

Good work guys! We have our servers set up in a weird way, I'm pretty certain its not been compromised though. Writing down those commands for further reference.