Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

How can I close a root process "unknown TCP" that shows up in nethogs?

I think my box has been pwned and using nethogs I see a root process of "unknown TCP". Can anyone tell me if this an expected process, what it may be for and if/how I can close it.

I changed my user password to try and stop this person but I am unsure yet if that is enough. enter image description here

UPDATE Now I am also seeing this.. so pwned? enter image description here

share|improve this question
    
Post the log entry in question. –  bodhi.zazen Jan 6 at 21:42
    
@bodhi.zazen Sorry, how do I post the log? Where can I find it? –  dibs Jan 6 at 21:49
    
Post a screenshot or more information on what you are looking at or use an alternate tool, such as sudo netstat -ntulp or sudo lsof -i -n -P –  bodhi.zazen Jan 6 at 21:52
    
@bodhi.zazen Does that image tell you enough? –  dibs Jan 6 at 21:59
1  
I don't think you are necessarily rooted - nethogs says "unknown TCP" with 0 bytes is expected: sourceforge.net/p/nethogs/bugs/17 –  ImaginaryRobots Jan 6 at 22:14

1 Answer 1

up vote 2 down vote accepted

The "Nethogs" package will always show a fake process called "unknown TCP", that corresponds to everything it can't identify. Notice that it doesn't have a process ID, and the amount of data is shown as 0, indicating that there isn't any unknown traffic.

Here's the line from the nethogs source code where that line gets initialised:

unknowntcp = new Process (0, "", "unknown TCP");

(Source code download, look in process.cpp)

There's also a bug report on the nethogs sourceforge page explaining that it's normal: http://sourceforge.net/p/nethogs/bugs/17/

The "remote-login-service" process shown is owned by the lightdm user which is your login screen, and hasn't sent or received any data. I'm not sure if it normally runs by default, but it doesn't seem to be doing anything with the network in the screenshot you posted, so it should also be safe.

http://packages.ubuntu.com/saucy/remote-login-service

So, based on what you've posted, nothing appears to be out of the ordinary and (unless you find other evidence of problems) your computer is most likely secure. If you are truly worried, you could do a fresh install just to be sure.

share|improve this answer
    
Thanks for the help with this. I have been getting lots of other ip ranges showing up in nethogs too when nobody is using the machine. I think I have got a problem still as I seem to be using about 500Mb per hour in traffic. –  dibs Jan 7 at 0:29
    
That amount of traffic is definitely suspicious. Make backups, wipe your hard drive, and do a clean install from a known-good installer DVD. –  ImaginaryRobots Jan 7 at 17:09
    
you might also want to install and run chkrootkit and rkhunter, which should help detect intrusions. –  ImaginaryRobots Jan 7 at 17:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.