Latest LQ Deal: Complete CCNA, CCNP & Red Hat Certification Training Bundle
Go Back > Forums > Linux Forums > Linux - Newbie
User Name
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!


  Search this Thread
Old 11-05-2012, 05:35 PM   #1
Registered: Sep 2012
Posts: 372

Rep: Reputation: 1
Learning about IDS

I wanted to learn more about how Intrusion Detection worked so I searched for "How to write IDS in bash".
I found that netstat -an | grep LISTEN | grep <port number> would find ports in use by testing on the returned response ($?). But this also returns about a dozen of lines like:
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 6220 /tmp/ssh-qUrvMutm1987/agent.1987

But the I-node numeric sequence is irregular which puzzles me??
Is an I-node not a port number?? Confused!
If ACC means waiting for a connection does that also imply the port is in service and waiting for a specific external input??
Perhaps someone can clarify for me please and thanks.
Old 11-05-2012, 05:41 PM   #2
LQ Guru
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.9, Centos 7.3
Posts: 17,406

Rep: Reputation: 2396Reputation: 2396Reputation: 2396Reputation: 2396Reputation: 2396Reputation: 2396Reputation: 2396Reputation: 2396Reputation: 2396Reputation: 2396Reputation: 2396
You should read the netstat man page. There are many protocols that could be used.
In normal usage, its usually either tcp or udp or unix sockets.
Old 11-05-2012, 06:12 PM   #3
Registered: Sep 2012
Posts: 372

Original Poster
Rep: Reputation: 1
Learning about IDS

Thanx 4 the url. I had blindly used the netstat line as it had been presented. Even in my man page the distinction of Connect, Waiting for, and Disconnect was not as obvious. Sometimes the man page is far too specific and lacks sufficient explanation unless one is totally awash with the subject.

I still don't understand why the I-nodes are not numerically sequenced?
Regarding the protocols; I would think that is not useful here since I want the state of the port and a port cannot as far as I know be connected in multiple protocols simultaneously only sequentially if that.
In fact I am not sure why I am getting this dozen or so since the last grep specifies a particular port which is not any of the I-nodes shown tho it was not necessary to list all of them. Thanks tho 4 the url again


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] RHCSA learning... RHEL6 or CENT OS for learning shejin983 Linux - Server 4 10-27-2012 09:16 AM
E-learning learning, VLS want to help other learn? scheidel21 General 0 04-06-2010 11:19 AM
Ids SBN Linux - Security 1 03-11-2007 10:49 PM
adding pci device ids to pci.ids xerxex Linux - General 0 01-18-2006 06:36 PM
Ids? zuessh Linux - Security 9 04-26-2003 05:48 AM > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 03:02 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration