Hi,
Just today i was used the command iptraf and found an ip that is accessing my server (or trying to access) using ftp. Basically there is no ftp user in my server except myself. thus it was suspecious. I was logged in the server using ssh from remote. Thus there was no way to terminate the connection using ifdown eth0. what should i do when i found an ip is accessing in a port and when i want to stop (kill the session) him? i mean what are the was/commands?also how can i know what he is actually doing?I need to kill say A.A.A.A since he is accessing my server on ftp. or more clearely, when many people are accessing ftp, only that person? And is there any other way to get know except iptraf?

please help me...

who -u will display logged in users along with their pid (not sure if that applies to ftp users also). You can then use the kill command to kill the unauthorised user. Ethereal is a good program to monitor incoming & outgoing traffic. Typing as root: netstat -atu will show you a list of udp & tcp sockets that are open.

Do you have any ftp-related entries in your ftp or system logs?

well, great mistake i did is no ftp log.

but what to terminate a connection (like if an ip is consuming a huge bandwidth in www/ftp and i just want to kill his session but to alive others...)

Well you can kill his session by terminating the process ID like {BBI}Nexus{BBI} mentioned. You can also block his IP using iptables.

That being said, it's important to determine if he had access to the system, especially if you don't allow anonymous FTP.

huh... ftp is not working... see the http://www.linuxquestions.org/questi...54#post2684454 for more details...