From owner-freebsd-ports@FreeBSD.ORG  Fri Oct 29 17:41:52 2004
Return-Path: <owner-freebsd-ports@FreeBSD.ORG>
Delivered-To: freebsd-ports@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 415FA16A4D1
	for <ports@FreeBSD.org>; Fri, 29 Oct 2004 17:41:52 +0000 (GMT)
Received: from kruger.drs-sss.com (kruger.drs-sss.com [12.153.72.219])
	by mx1.FreeBSD.org (Postfix) with SMTP id 6FCD143D5C
	for <ports@FreeBSD.org>; Fri, 29 Oct 2004 17:41:51 +0000 (GMT)
	(envelope-from david.hutchens@drs-sss.com)
Received: (qmail 57521 invoked by uid 98); 29 Oct 2004 17:39:03 -0000
Received: from david.hutchens@drs-sss.com by kruger.drs-sss.com by uid 82 with
	qmail-scanner-1.22  ( Clear:RC:1(192.168.115.233):. 
	Processed in 0.118514 secs); 29 Oct 2004 17:39:03 -0000
X-Qmail-Scanner-Mail-From: david.hutchens@drs-sss.com via kruger.drs-sss.com
X-Qmail-Scanner: 1.22 (Clear:RC:1(192.168.115.233):. Processed in 0.118514
	secs)
Received: from rads61.drs-sss.com (HELO rads61) (192.168.115.233)
  by kruger.drs-sss.com with SMTP; 29 Oct 2004 17:39:02 -0000
From: "hutchens" <david.hutchens@drs-sss.com>
To: <cordeiro@nic.br>
Date: Fri, 29 Oct 2004 13:41:45 -0400
Message-ID: <D3E7D4B9902BD6119C3B0002B395D1AE02A5DE64@voodoo.drs-sss.com>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook CWS, Build 9.0.6604 (9.0.2911.0)
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409
cc: ports@FreeBSD.org
Subject: RE:BindShell False Positives FBSD-4.10.p3
X-BeenThere: freebsd-ports@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Porting software to FreeBSD <freebsd-ports.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ports>,
	<mailto:freebsd-ports-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ports>
List-Post: <mailto:freebsd-ports@freebsd.org>
List-Help: <mailto:freebsd-ports-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ports>,
	<mailto:freebsd-ports-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 29 Oct 2004 17:41:52 -0000

Afternoon;

Here's sample output from netstat -an when Chkrootkit Reports a Bindshell
Infection on port 114:

Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)


             *.*                    LISTEN
udp4       0      0  127.0.0.1.4701         127.0.0.1.123
udp4     114      0  *.1355                 *.*



Sincerely;

David Hutchens III
Network Technician
DRS Surveillance Support Systems - A division of DRS Technologies.
(727) 541-6681 ext.3313
david.hutchens@drs-sss.com <mailto:david.hutchens@drs-sss.com>