7

I run Ubuntu 9.04 and was recently told by my university that my computer is massively port scanning the network.

I am interesting in learning more about figuring out what is happening to stop it, but I am lost at where to begin. What steps should I take (or files to look at) to figure out what is happening?

Improve this question
0

3 Answers 3

Reset to default
2

Use a network sniffer like Wireshark to see what kind of traffic is send over your network interface?

Improve this answer
2 
$ sudo apt-get install htop

It's a cooler version of 'top' so you can go through all the processes. Check them all out, see if you see one in particular that is running which you didn't expect.
Check your crontab. Check "ps waux | less".
Next: download rootkit scanners, make sure you didn't get, in the parlance, pwned.

Improve this answer
-1

Sounds like your university (like mine and most) is just anti-Linux or at least Windows-centric. Does anyone else running Linux (Ubuntu or otherwise) get a similar warning? The above mentioned methods (htop & wireshark) of monitoring should help if it is compromised (very unlikely).

Improve this answer
1
  • It's also possible that, during a setup, it scanned the whole network/domain to find printers, domain controllers, etc etc.. A one-time deal which showed as an unusual spike. Who knows.
    – Trevoke
    Feb 5, 2010 at 18:29

You must log in to answer this question.