Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I run Ubuntu 9.04 and was recently told by my university that my computer is massively port scanning the network.

I am interesting in learning more about figuring out what is happening to stop it, but I am lost at where to begin. What steps should I take (or files to look at) to figure out what is happening?

share|improve this question
add comment

3 Answers

Use a network sniffer like Wireshark to see what kind of traffic is send over your network interface?

share|improve this answer
add comment
$ sudo apt-get install htop

It's a cooler version of 'top' so you can go through all the processes. Check them all out, see if you see one in particular that is running which you didn't expect.
Check your crontab. Check "ps waux | less".
Next: download rootkit scanners, make sure you didn't get, in the parlance, pwned.

share|improve this answer
add comment

Sounds like your university (like mine and most) is just anti-Linux or at least Windows-centric. Does anyone else running Linux (Ubuntu or otherwise) get a similar warning? The above mentioned methods (htop & wireshark) of monitoring should help if it is compromised (very unlikely).

share|improve this answer
    
It's also possible that, during a setup, it scanned the whole network/domain to find printers, domain controllers, etc etc.. A one-time deal which showed as an unusual spike. Who knows. –  Trevoke Feb 5 '10 at 18:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.