output from netstat

[dsr at tao.merseine.nu]

On Sat, Oct 29, 2005 at 06:45:23PM -0400, jbk wrote:
> As root, do netstat -tlp
> 
> I did that, I am not going to post the output unless 
> requested. The processes that were listed include 
> "rpc.<service>  smbd and a few others. Why are these 
> processes listening on all addresses instead of the local 
> 127. and my lan of 10.251.227. . It is disconcerting when my 
>  samba logs list a machine as 0.0.0.0 requesting 
> connections to services. This isn't a recent development it 
> appeared about a year ago when I upgraded to the Fedora 
> distribution from RH8.0.

Well, that's the way Fedora chooses to do it by default. If you
don't like it, each daemon or daemon controller ought to have
some method for limiting the interfaces it listens to. Failing
that, netfilter is your friend:

ipfilter -A INPUT -p tcp -i ! eth1 --dport 137 -j DROP

for example, will stop anything coming in for your port 137
unless it arrives on eth1. (Haven't tested this, so do read
the docs before implementing.)

-dsr-