today my Ubuntu 12.04 pc crashed and I had to force kill it, which it never does. Then after booting back up I ran wireshark and saw random dns requests and a protocol I've never seen before 'dec dna' as well a lot of weird udp streams. I ran
netstat -la and this was the output:
root@linuxbox:~# netstat -la
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 localhost:domain *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 localhost:ipp *:* LISTEN
tcp 0 0 localhost:mysql *:* LISTEN
tcp 0 0 *:http *:* LISTEN
tcp6 0 0 [::]:ssh [::]:* LISTEN
tcp6 0 0 ip6-localhost:ipp [::]:* LISTEN
udp 0 0 *:1900 *:*
udp 0 0 *:40322 *:*
udp 0 0 localhost:domain *:*
udp 0 0 localhost:ntp *:*
udp 0 0 *:ntp *:*
udp 0 0 *:mdns *:*
udp6 0 0 fe80::7879:ff:fe00::ntp [::]:*
udp6 0 0 fe80::12fe:edff:fe2:ntp [::]:*
udp6 0 0 fe80::216:6fff:fe4d:ntp [::]:*
udp6 0 0 ip6-localhost:ntp [::]:*
udp6 0 0 [::]:ntp [::]:*
udp6 0 0 [::]:47318 [::]:*
udp6 0 0 [::]:mdns [::]:*
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 11019 /tmp/.X11-unix/X0
unix 2 [ ACC ] STREAM LISTENING 11618 /tmp/.winbindd/pipe
unix 2 [ ACC ] STREAM LISTENING 13721 /tmp/keyring-HyNZDz/control
unix 2 [ ACC ] STREAM LISTENING 13860 /tmp/ssh-COlALKGR2295/agent.2295
unix 2 [ ACC ] STREAM LISTENING 13890 /tmp/.ICE-unix/2295
unix 2 [ ACC ] STREAM LISTENING 14080 /tmp/keyring-HyNZDz/pkcs11
unix 2 [ ACC ] STREAM LISTENING 14084 /tmp/keyring-HyNZDz/ssh
unix 2 [ ACC ] STREAM LISTENING 14085 /tmp/keyring-HyNZDz/gpg
unix 2 [ ACC ] STREAM LISTENING 10790 /var/run/acpid.socket
unix 2 [ ACC ] SEQPACKET LISTENING 7973 /run/udev/control
unix 19 [ ] DGRAM 10025 /dev/log
unix 2 [ ACC ] STREAM LISTENING 7850 @/com/ubuntu/mountall
...and many, many more i cant fit here.
... can anyone tell me what those odd listening services are? I had a web server on my home lan and just today moved it to a vps for security reasons. I had noticed strange things going on with the network before week, but this seems abnormal. I've just never seen this before. Can someone help me? Rkhunter does not seem to find anything. I logged into my openvpn, ran wireshark again and noticed ssh connections from random ips. I ran 'who' and nobody else was here. But then wireshark started displaying tcp redirect of my openvpn traffic, repeatedly until I killed the connection. I should note that this is also now happening on my other ubuntu computer, which is on the same network.
I no longer require assistance with this. A little more digging has informed me that these are normal services, and that the output of ls -la and ls -a are not the same thing... I have not slept in two days, so forgive my ignorance.