Chinaunix

标题: 请大家帮忙看看UNIX主机是不是被攻击或病毒 [打印本页]

作者: Raistlin 时间: 2007-07-19 10:37
标题: 请大家帮忙看看UNIX主机是不是被攻击或病毒
最近UNIX主机上的JAVA应用经常报"Too many open files"，但系统rlim_fd_cur已经设为8192,足够用了
经过观察，发现经常会有大量顺序的端口BOUND，请大家帮忙看看会是什么原因？
# netstat -na | grep BOUND | wc -l
   942

# lsof -p 2728
java 2728 root  133u  IPv4 0x35d754e2338       0t0    TCP *:38633 (BOUND)
java 2728 root  134u  IPv4 0x35d754fb228       0t0    TCP *:38634 (BOUND)
java 2728 root  135u  IPv4 0x318269f2658       0t0    TCP *:38635 (BOUND)
java 2728 root  136u  IPv4 0x305573e64e0       0t0    TCP *:38636 (BOUND)
java 2728 root  137u  IPv4 0x333e58d0350       0t0    TCP *:38637 (BOUND)
java 2728 root  138u  IPv4 0x318269ff850       0t0    TCP *:38638 (BOUND)
java 2728 root  139u  IPv4 0x333e5e2a7f0       0t0    TCP *:38639 (BOUND)
java 2728 root  140u  IPv4 0x371975e7240       0t0    TCP *:38640 (BOUND)
java 2728 root  141u  IPv4 0x3164b452ac0       0t0    TCP *:38641 (BOUND)
java 2728 root  142u  IPv4 0x35d754f39c8       0t0    TCP *:38642 (BOUND)
java 2728 root  143u  IPv4 0x333e58ac338       0t0    TCP *:38643 (BOUND)
java 2728 root  144u  IPv4 0x333e58e6348       0t0    TCP *:38644 (BOUND)
java 2728 root  145u  IPv4 0x371975f9e48       0t0    TCP *:38645 (BOUND)
java 2728 root  146u  IPv4 0x371975f0068       0t0    TCP *:38646 (BOUND)
java 2728 root  147u  IPv4 0x333e57f10d8       0t0    TCP *:38647 (BOUND)
java 2728 root  148u  IPv4 0x3617163fb30       0t0    TCP *:38648 (BOUND)
java 2728 root  149u  IPv4 0x325c21daad0       0t0    TCP *:38649 (BOUND)
java 2728 root  150u  IPv4 0x325c21e6940       0t0    TCP *:38650 (BOUND)
java 2728 root  151u  IPv4 0x333e5751238       0t0    TCP *:38651 (BOUND)
java 2728 root  152u  IPv4 0x35b576c8638       0t0    TCP *:38652 (BOUND)
java 2728 root  153u  IPv4 0x333e58d0c50       0t0    TCP *:38653 (BOUND)
java 2728 root  154u  IPv4 0x35d75503258       0t0    TCP *:38654 (BOUND)
java 2728 root  155u  IPv4 0x35b576c9838       0t0    TCP *:38655 (BOUND)
java 2728 root  156u  IPv4 0x333e586fe28       0t0    TCP *:38656 (BOUND)
java 2728 root  157u  IPv4 0x35d754ff568       0t0    TCP *:38657 (BOUND)
java 2728 root  158u  IPv4 0x35d754eb3e8       0t0    TCP *:38658 (BOUND)
java 2728 root  159u  IPv4 0x35d754db6d0       0t0    TCP *:38659 (BOUND)
java 2728 root  160u  IPv4 0x371975e50c8       0t0    TCP *:38660 (BOUND)
java 2728 root  161u  IPv4 0x35d754f6db8       0t0    TCP *:38661 (BOUND)
java 2728 root  162u  IPv4 0x371975f8ac8       0t0    TCP *:38662 (BOUND)
java 2728 root  163u  IPv4 0x36171651e28       0t0    TCP *:38663 (BOUND)
java 2728 root  164u  IPv4 0x36300e27e38       0t0    TCP *:38664 (BOUND)
java 2728 root  165u  IPv4 0x35b576f0f70       0t0    TCP *:38665 (BOUND)
java 2728 root  166u  IPv4 0x35d754d1260       0t0    TCP *:38666 (BOUND)
java 2728 root  167u  IPv4 0x35d754dc1c8       0t0    TCP *:38667 (BOUND)
java 2728 root  168u  IPv4 0x333e5da5238       0t0    TCP *:38668 (BOUND)

作者: cndefu 时间: 2007-07-20 09:18
有后门软件呀，你小心。赶快停掉后门进程吧！

作者: Raistlin 时间: 2007-07-20 11:46

原帖由 cndefu 于 2007-7-20 09:18 发表
有后门软件呀，你小心。赶快停掉后门进程吧！

这些端口号都是在同一个JAVA进程里的呀，怎么停掉后门进程？

欢迎光临 Chinaunix (http://bbs.chinaunix.net/)