Re: [gentoo-user] Strange outbound requests

[Grant]

>>> `watch` isn't going to help too much unless you're looking at it. Append
>>> the
>>> output to some log file instead. I chose netstat because its output
>>> looked
>>> easier to parse with a stupid regexp.
>>>
>>>  while true; do
>>>    netstat -antp | grep ':993 '>>  mystery.log;
>>>    sleep 1;
>>>  done;
>>>
>>> You'll want to change the port -- I tested to make sure that was really
>>> logging my Thunderbird connections.
>>
>>
>> I'm still getting the blocked outbound requests to port 3680 on my
>> firewall and I'm running the above script (changed 993 to 3680) on the
>> local system indicated by SRC in the firewall log, but mystery.log
>> remains empty.  I tested the script with other ports and it seems to
>> be working fine.
>>
>> Also the MAC indicated in the firewall log is 14 blocks long and the
>> local system in question has a MAC address 6 blocks long according to
>> ifconfig, but the 6 blocks from ifconfig do match 6 of the blocks
>> reported by the firewall.
>>
>> Does this make sense to anyone?
>>
>
> Are you running it as root? If not, you could be missing some connections.

I'm running it as root.

> I also typed the 't' in netstat out of habit -- that limits the output to
> tcp connections. You can remove it to catch the UDP ones.

According to the firewall log, the 3680 requests are TCP connections,
but I just switched to 'lsof -i' anyway.

- Grant