Re: Nmap and xlogmaster

[Lamont Granquist <lamontg () raven genome washington edu>]

On Fri, 29 Jan 1999, Steve Palmer wrote:
> My  NID kicks off a shell script that does an nslookup, whois' (arin, apnic,
> nic.mil, nic.gov, and internic), does an nmap probe, then emails me the
> results. [....]
> I would like to get my hands on the tool that they are using.[...]
> that some of these sites are owned.  I thought the tool might be mscan, sscan,
> or some variant, but I have not yet been able to reproduce the desired "#" (in
> my lab of course).  If anyone could point me in the right direction, I would
> greatly appriciate it.

Try also hitting the systat port and capturing the output along with the
nslookup, etc.  Since these are 0wn3d poor-security linux boxes you'll
come across ones that have systat open, and that gives you a 'ps xauww'
and you should be able to figure out which proc is bashing on your system.

-- 
Lamont Granquist                       lamontg () raven genome washington edu
Dept. of Molecular Biotechnology       (206)616-5735  fax: (206)685-7344
Box 352145 / University of Washington / Seattle, WA 98195
PGP pubkey: finger lamontg () raven genome washington edu | pgp -fka