Re: [gentoo-user] Strange outbound requests

[Hinnerk van Bruinehsen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 21.01.2012 02:39, Michael Mol wrote:
> On Fri, Jan 20, 2012 at 6:34 PM, Grant <emailgrant@×××××.com>
> wrote:
>>>>>>>> My firewall is blocking periodic outbound connections
>>>>>>>> to port 3680 on a Rackspace IP.  How can I find out
>>>>>>>> more about what's going on?  Maybe which program is
>>>>>>>> generating the connection requests?
>>>>>>>
>>>>>>> Uh, a packet sniffer?
>>>>>>>
>>>>>>> I have an old laptop here that I have a second
>>>>>>> (cardbus) network card in. Really cheap and cheerful -
>>>>>>> the sort of thing you can pick up on freecycle. It's
>>>>>>> been a while since I've done anything like this, but
>>>>>>> you should be able to stick a box like that between the
>>>>>>> router and the rest of your network, run Wireshark and
>>>>>>> filter on that port. If the connection is encrypted
>>>>>>> then at least you'll see the originating IP.
>>>>>>
>>>>>> I've actually got the originating local IP from the
>>>>>> shorewall log. I'm just trying to figure out which
>>>>>> program and maybe which user on that system is generating
>>>>>> the outbound requests to port 3680.  Is there any way to
>>>>>> get more info without setting up a new box?
>>>>>>
>>>>>>> I don't think it's relevant that the IP belongs to
>>>>>>> Rackspace - don't they just hire (virtual) servers to
>>>>>>> anyone that wants one?
>>>>>>
>>>>>> Yeah I just meant the request could be going to
>>>>>> "anyone".
>>>>>>
>>>>>> - Grant
>>>>>
>>>>> Are you running NPDS in your LAN and is it configured to
>>>>> access any sites on rackspace? -- Regards, Mick
>>>>
>>>> I am not running NPDS.  I looked it up when I was researching
>>>> port 3680 and read about it for the first time.  I know which
>>>> machine is making the requests.  Any way to drill down
>>>> further?
>>>
>>> If the machine is running linux, then 'watch "lsof -n|grep
>>> TCP|grep 3680"' as root is a sloppy but effective way to find
>>> it. There's probably some way to set up a firewall rule on the
>>> host in question that logs out the user and (possibly) PID of
>>> the connection, but I don't know.
>>
>> All of my systems run Gentoo. :)  Where does watch come from?
>
> shortcircuit@saffron ~ $ equery b `which watch`
> /usr/lib64/portage/pym/portage/package/ebuild/config.py:353:
> UserWarning: 'cache.metadata_overlay.database' is deprecated:
> /etc/portage/modules (user_auxdbmodule, modules_file)) * Searching
> for /usr/bin/watch ... sys-process/procps-3.2.8_p11
> (/usr/bin/watch) shortcircuit@saffron ~ $
>
> Incidentally, does anyone know why all my portage-related
> executions get that 'cache.metadata_overlay.database' warning? I've
> been seeing it for weeks, even on fresh installs. I would have
> assumed a bug like that would have been fixed by now.
>
>

You get the warning, because you hat a directory /etc/portage/modules
- - simply remove it (or move it, if you are afraid to break something).
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJPGhmmAAoJEJwwOFaNFkYcBFQIAJlWjVqACiqCSxwNnigFvXfa
olRedLttuzZUGcJKsx59gptBeaRxSc/kQ7oEai6QSmFzY7nq5bsz3QMtJEB5QJpo
rOwD844f6pKRKv4GWjCg++1W6LJJcbMs4s0TARLM1+o+uaTC8Lgb/tjdJCov6cWF
Hhl/KxRpdy/mCL/QB7/kOQRL/lDryy23xoxCln8S60xzD8pWQ/HsPdMNKg2LDpOL
RxKyywJQ/y35OTJU60w6vgkPhJnhQQ4WgzrruvsNCSS60t1Mr51XXdmj5ATEChCw
qaxml/3x1eHc4L2j5GekjED0PL2fROOTYujoDlpuTHGTUy5tHNvww+/2upqLf9U=
=t8zl
-----END PGP SIGNATURE-----