| 1 |
>> > `watch` isn't going to help too much unless you're looking at it. Append |
| 2 |
>> > the output to some log file instead. I chose netstat because its output |
| 3 |
>> > looked easier to parse with a stupid regexp. |
| 4 |
>> > |
| 5 |
>> > while true; do |
| 6 |
>> > netstat -antp | grep ':993 ' >> mystery.log; |
| 7 |
>> > sleep 1; |
| 8 |
>> > done; |
| 9 |
>> > |
| 10 |
>> > You'll want to change the port -- I tested to make sure that was really |
| 11 |
>> > logging my Thunderbird connections. |
| 12 |
>> |
| 13 |
>> I'm still getting the blocked outbound requests to port 3680 on my |
| 14 |
>> firewall and I'm running the above script (changed 993 to 3680) on the |
| 15 |
>> local system indicated by SRC in the firewall log, but mystery.log |
| 16 |
>> remains empty. I tested the script with other ports and it seems to |
| 17 |
>> be working fine. |
| 18 |
>> |
| 19 |
>> Also the MAC indicated in the firewall log is 14 blocks long and the |
| 20 |
>> local system in question has a MAC address 6 blocks long according to |
| 21 |
>> ifconfig, but the 6 blocks from ifconfig do match 6 of the blocks |
| 22 |
>> reported by the firewall. |
| 23 |
>> |
| 24 |
>> Does this make sense to anyone? |
| 25 |
> |
| 26 |
> Does not make sense to me, sorry. :-( |
| 27 |
> |
| 28 |
> Have you tried running the script on lsof instead? |
| 29 |
|
| 30 |
OK I changed 'netstat -antp' to 'lsof -i'. |
| 31 |
|
| 32 |
- Grant |
Archives