X fails

[Jim Bonnet]

Richard R. Sivernell wrote:
> On Wed, 03 Jul 2002 11:20:04 -0700
> Jim Bonnet <jimbo at sysdump.com> wrote:
> 
> 
>>>    Checked the XF86Config-4 on 2 systems and they are the same. common
>>>    monitor
>>>keyboard mouse. thru switch. The 2 systems have the same video cards too.
>>
>>what did strace show?? Some file can load into memory because of an IO 
>>error..
>>
>>-jim
>>
>>_______________________________________________
>>Linux-users mailing list - http://linux-sxs.org/mailman/listinfo/linux-users
>>Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.
> 
> 
> Jim
> 
>  strace output
> [pid   896] socket(PF_UNIX, SOCK_STREAM, 0) = 4
> [pid   896] connect(4, {sin_family=AF_UNIX, path="/var/run/.nscd_socket"}, 110) =
> 0
> [pid   896] write(4, "\2\0\0\0\4\0\0\0\30\0\0\0", 12) = 12
> [pid   896] write(4, "Sivernell.sivernell.net\0", 24) = 24
> [pid   896] read(4, "\0\0\0\0\1\0\0\0\30\0\0\0\1\0\0\0\2\0\0\0\4\0\0\0\1\0\0"...,
> 32) = 32
> [pid   896] readv(4, [{"Sivernell.sivernell.net\0", 24}, {"\n\0\0\0", 4},
> {"\300\250\1(", 4}], 3) = 32
> [pid   896] read(4, "Sivernell\0", 10)  = 10
> [pid   896] close(4)                    = 0
> [pid   896] setsockopt(3, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0
> [pid   896] connect(3, {sin_family=AF_INET, sin_port=htons(6000),
> sin_addr=inet_addr("192.168.1.40")}}, 16) = -1 ECONNREFUSED
>                                                        (Connection refused)      
>                <<<<<<<<<<<<<<<<<<<<<<<<<
> [pid   896] close(3)                    = 0
> [pid   896] rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
> [pid   896] rt_sigaction(SIGCHLD, NULL, {SIG_DFL}, 8) = 0
> [pid   896] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
> [pid   896] nanosleep({1, 0},  <unfinished ...>
> [pid   901] getpid()                    = 901
> [pid   901] close(255)                  = 0
> 
> found this in portsentry.conf
> #######################
> # Port Configurations #
> #######################
> #
> #
> # Some example port configs for classic and basic Stealth modes
> #
> # I like to always keep some ports at the "low" end of the spectrum.
> # This will detect a sequential port sweep really quickly and usually
> # these ports are not in use (i.e. tcpmux port 1)
> #
> # ** X-Windows Users **: If you are running X on your box, you need to be sure
> # you are not binding PortSentry to port 6000 (or port 2000 for OpenWindows
> # users). Doing so will prevent the X-client from starting properly.
> #
> # These port bindings are *ignored* for Advanced Stealth Scan Detection Mode.
> #
> 
> # Un-comment these if you are really anal:
> #TCP_PORTS="1,7,9,11,15,70,79,80,109,110,111,119,138,139,143,512,513,514,515,540
> #,635,
>  
> 1080,1524,2000,2001,4000,4001,5742,6000,6001,6667,12345,12346,20034,30303,32771,
> 32772,
>   32773,32774,31337,40421,40425,49724,54320"
> #UDP_PORTS="1,7,9,66,67,68,69,111,137,138,161,162,474,513,517,518,635,640,641,66
> #6,700,
> 2049,32770,32771,32772,32773,32774,31337,54321"
> #
> 
>   

Well it sure looks to me like something in the network is broken. Can 
you telnet to localhost port 6000?

strange problem..



-- 
quattro... the unfair advantage...