Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I run Ubuntu 9.04 and was recently told by my university that my computer is massively port scanning the network.

I am interesting in learning more about figuring out what is happening to stop it, but I am lost at where to begin. What steps should I take (or files to look at) to figure out what is happening?

share|improve this question

Use a network sniffer like Wireshark to see what kind of traffic is send over your network interface?

share|improve this answer
$ sudo apt-get install htop

It's a cooler version of 'top' so you can go through all the processes. Check them all out, see if you see one in particular that is running which you didn't expect.
Check your crontab. Check "ps waux | less".
Next: download rootkit scanners, make sure you didn't get, in the parlance, pwned.

share|improve this answer

Sounds like your university (like mine and most) is just anti-Linux or at least Windows-centric. Does anyone else running Linux (Ubuntu or otherwise) get a similar warning? The above mentioned methods (htop & wireshark) of monitoring should help if it is compromised (very unlikely).

share|improve this answer
It's also possible that, during a setup, it scanned the whole network/domain to find printers, domain controllers, etc etc.. A one-time deal which showed as an unusual spike. Who knows. – Trevoke Feb 5 '10 at 18:29

You must log in to answer this question.