defunct netstat process

matthew2k · n00b Joined: 14 Mar 2003 Posts: 27 Location: Germany

Hey guys!

In light of the latest news about the gnu ftp being hacked I just started to wonder where this defunct netstat process is coming from I am seeing almost constantly. I mean there is even a defunct netstat process when I didn't even run netstat at all the whole time the computer was on. I have already checked the init scripts if something there makes use of it- no luck at all.

Now I am somewhat afraid that I might have been hacked too- even though it would be kinda strange because my computer is not always on the net, I don't have a static IP... so a hacker wouldn't have much fun trying to hack my box. (not much time for hacking: changing IP adresses and such...)

Does anyone see the same probs on his/her box too? And does anyone have an explanation for this?

Thanks in advance for any clues...!!
- matthias

kallamej · Posted: Sat Aug 16, 2003 2:55 pm Post subject:

I have noticed that one too. Once I tried to find out when I got it. What I found out was that it appeared when I logged in to the Gentoo forum and disappeared when I quit MozillaFirebird.

But now I don't seem to have it. The only major package I have updated since then is my kernel from gentoo-sources 2.4.20-r5 to -r6. At the same time I also enabled low-level grsecurity. I didn't have any of that before. I'll boot my old kernel to see what happens.

EDIT: Ok booting from 2.4.20-r5 with no grsecurity gives me

devon · l33t Joined: 23 Jun 2003 Posts: 943

Perhaps this explains the "<defunct>". From "man ps":

kallamej · Posted: Sun Aug 17, 2003 12:18 pm Post subject:

I know that. The question to me is why the parent process, in my case MozillaFirebird as far as I can tell, starts it when I log in to these forums. It is back now, btw. But only occasionally.
_________________
Please read our FAQ Forum, it answers many of your questions.
irc: #gentoo-forums on irc.libera.chat

Carlo · Developer Joined: 12 Aug 2002 Posts: 3356

Yes, found this one too, in Mozilla 1.4 lately.

Carlo
_________________
Please make sure that you have searched for an answer to a question after reading all the relevant docs.

Xiol · Apprentice Joined: 24 Jul 2003 Posts: 209 Location: UK

I got this one from Mozilla 1.4 too.

Check it's parent process with ps -A --forest and see what it's parent is.

smiler.se · Posted: Mon Aug 18, 2003 4:59 pm Post subject:

I can verify that this one has been in MozillaFirebird for some time. Ive never cared about it really but it would be interessting to know why Mozilla calls netstat :!:

_________________
Christian

Sig out of date. Please upgrade to a newer one.