This is a discussion on Raw sockets and system compromise within the Linux Security forums, part of the System Security and Security Related category; I've been trying to secure my Slackware Linux 8.0 system by disabling unneeded services and closing open ports. ...
|
|||||||
| FAQ | Members List | Calendar | Search | Today's Posts | Mark Forums Read |
|
|||
|
I've been trying to secure my Slackware Linux 8.0 system
by disabling unneeded services and closing open ports. I've already enabled ipchains for linux 2.2.19, but I still want to close down most of the ports. I'm able to close down all listening ports except for these (wrapping fixed by me): # netstat -lp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name raw 0 0 *:icmp *:* 7 - raw 0 0 *:tcp *:* 7 - Notice that the program name is not given even with -p. What are these "raw" ports used for? Could this be a sign of system compromise? |