| T.R | Title | User | Personal
Name | Date | Lines |
|---|
| 532.1 | | ANNECY::ROBERTS | Nigel@AEO, DTN 887-4077 | Tue Aug 18 1987 13:19 | 3 |
| Looks rather like a process-id to me.
Nigel
|
| 532.2 | random network links? | FROST::HARRIMAN | no caps lock here | Tue Aug 18 1987 15:36 | 10 |
|
What was the process doing to your DECNET account? Any ideas how
many images it invoked, how much virtual memory it used, etc?
We get those too. I always assumed they were just random objects
like pasthru mail processes that have no real names, just pids which
you could trace if you really had to (I have never had to).
/pjh
|
| 532.3 | Pick one | WKRP::LENNIG | Dave, SWS, @CYO Cincinnati | Tue Aug 18 1987 17:28 | 6 |
| I believe you get PIDs when
1) SET EXECUTOR DEFAULT PROXY [INCOMING or NONE] or
2) SET OBJECT name PROXY [INCOMING or NONE] or
3) NODE"":: explicit null access control string format is used
Dave
|
| 532.4 | No proxies.. | SNDBOX::SMITH | William P.N. (WOOKIE::) Smith | Thu Aug 20 1987 18:49 | 6 |
| Must have been 3), neither the FAL log nor the operators log gave
any clue as to who it was or what they were doing. I usually toss
the FAL logs after I've checked them over, so I can't recheck....
Willie
|
| 532.5 | Addendum to .3 | WKRP::LENNIG | Dave, SWS, @CYO Cincinnati | Fri Aug 21 1987 11:01 | 5 |
| All three cases I describe are in the context of the originating
node, not the destination. In particular, cases one and two imply
that OUTGOING PROXY is disabled.
Dave
|
| 532.6 | REMACP? | AUNTB::SOEHL | On to Mt. Pilot | Fri Aug 21 1987 13:31 | 9 |
| If you do an "$ncp show know objects" you will see some of them
have a pid of a detached process (like REMACP) associated with them.
I wonder if accounting might not tell you something about that time
frame. For example, if someone does a "set host" to your machine,
it will tell you the node that it came from, and their remote username.
Hope this helps
Patrick
|
| 532.7 | Username can look like PID | DELNI::CANTOR | Dave C. | Tue Aug 25 1987 04:48 | 19 |
| In your SYS$SYLOGIN (I assume you have one), put the commands
$ IF F$MODE() .EQS. "NETWORK" THEN SHOW LOGICAL SYS$NET
Examine the NETSERVER.LOG files. The result of the SHOW command
will be something like
"CSCMA::0=20A02073/..............................."
or
"CSCMA::0=20A02073 /..........................."
If the number of characters between the equal sign and the
slash is 8, it's a PID, if 12, it's a username.
There's no reason a hacker with privilege couldn't create
a username 20A02073 in order to make someone at the destination
node think they were seeing a PID, but now you know better.
Dave C.
|