Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I noticed some strange python process trying to access IPs which seem to belong to Google, such as (according to whois). The process has this initialization command in ps:

bash -c P=python2; $P -V 2>/dev/null || P=python; "$P" -c 'import sys; \
  skip_imports=1; verbosity=2; exec compile(, \
  "", "exec")'

Any ideas what this could be?

share|improve this question
Does not look good from the security POV. Please do #locate and try to open that file. – lzap May 16 '11 at 9:04
Try running pstree -H the_pid_of_that_procees. It could give you better clues as to what exactly spawned that. – Mat May 16 '11 at 9:08
I have seen Google using python for internal components before, but this is a bit odd. All of the tips here are good: find, check out the process tree, and take a look in the proc filesystem. – jcrawfordor Aug 31 '11 at 20:20

ls -l /proc/<pid> and ls -l /proc/<pid>/fd may tell you more.

share|improve this answer
up vote 0 down vote accepted

Turns out it belongs to sshuttle which was running at that time.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.