View Single Post
  #6   (View Single Post)  
Old 22nd August 2008
J65nko J65nko is offline
Administrator
 
Join Date: May 2008
Location: Budel - the Netherlands
Posts: 3,505
Default

If ftp is running, whether that be from inetd or as standalone, it will show as a LISTEN in netstat -an output.

Code:
$ netstat -an -f inet

Active Internet connections (including servers)
Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)
tcp        0      0  *.21                   *.*                    LISTEN
tcp        0      0  *.6000                 *.*                    LISTEN
tcp        0      0  127.0.0.1.587          *.*                    LISTEN
tcp        0      0  127.0.0.1.25           *.*                    LISTEN
tcp        0      0  *.22                   *.*                    LISTEN
tcp        0      0  *.515                  *.*                    LISTEN
Active Internet connections (including servers)
Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)
udp        0      0  192.168.222.20.2012    194.165.35.111.123    
udp        0      0  192.168.222.20.7197    145.24.129.5.123      
udp        0      0  192.168.222.20.4237    213.154.229.26.123    
udp        0      0  192.168.222.20.3805    130.89.164.77.123     
udp        0      0  192.168.222.20.14453   213.249.66.35.123     
udp        0      0  *.514                  *.*
You check if inetd is running by the following:
Code:
$ pgrep inetd

26811

$ ps -aux | grep inetd

root     26811  0.0  0.1   440   840 ??  Is    12:53AM    0:00.00 inetd
__________________
You don't need to be a genius to debug a pf.conf firewall ruleset, you just need the guts to run tcpdump
Reply With Quote