Tons more traffic ppping from root.

Greetings,

I run Slackware 9.1 with dialup internet access.

I typically access my ISP by either utilizing a script run from root this
has the advantage that all system users have access to the connection. I
also use kppp from KDE.

One thing I started to notice was everything took longer via ppp script
fired up from root. I d'loaded ethereal and performed a couple of captures
one with KPPP and one from the root-run script.

Sure enough, the root-run script connection registered a fairly steady
stream of traffic over ppp0 regardless if anything apparent was going on or
not (i.e. when my e-mail client was checking for e-mail it was obvious
there would be traffic, but in the quite times in between e-mail checks the
traffic kept up a steady pace) whereas the KPPP connection's traffic was
very explainable by my activity on the system.

Looking at the conversations I see numerous conversations happening between
different clients on the same domain talking out of various ports to my port
1898. Each conversation is three packets going each way for a total of six
packets.

There are other systems that are scanning my port 1898 in a similar fashion.

I have run numerous virus scans of late. I found an HTML exploit on my
system which I have deleted (it was sitting in my mozilla cache) also found
was the "Linux/OSF-8759 virus" in various files sitting in a directory I
use to process downloads. I deleted all offending files (I do not execute
anything fom this directory). My ethereal traces turn up some remote tcp
ports near 3049 but nothing on my system. Numerous virus scans turn up
nothing and I just ran chkrootkit which also turns up nothing.

It appears I have something which gets executed along with ppp-go when I
root-run it. Have any of you ever seen any similar activity? I guess
tomorrow I repeat the same captures to see if I get the same results, I
guess I will.

Thanks
Mark

> It appears I have something which gets executed along with ppp-go when I
> root-run it. Have any of you ever seen any similar activity? I guess
> tomorrow I repeat the same captures to see if I get the same results, I
> guess I will.

# netstat -nlp | grep 1898

get the PID, and do

# ps ax | grep $PID

then you can see what is listening there. The fact that other clients are
connecting to you and not the other way around sounds a little funny to me.
How would they know you are running Cymtec secure management on your box?

The 6 packets sound like a tcp handshake and then tear-down.