[GRLUG] Rogue SSH connections

[Adam Tauno Williams]

On Sun, 2013-10-06 at 19:36 -0400, megadave wrote:
> Or even
> 
> lsof -i -n | grep TCP | grep -v LISTEN

That is a less than optimal use of lsof.

'netstat --listen --tcp --inet' would be better, or 'netstat --listen
--tcp --net --program --numeric'

or, as netstat is quasi-deprecated, even better to use "ss":

ss --listen --numeric --processes

ss allows very detailed filters can can return scads of information.

ss --listen --numeric --processes  --extended

-- 
Adam Tauno Williams <mailto:awilliam at whitemice.org> GPG D95ED383
Systems Administrator, Python Developer, LPI / NCLA