Журнал лабораторных работ

# /etc/hosts.deny: list of hosts that are _not_ allowed to access the system.
#                  See the manual pages hosts_access(5) and hosts_options(5).
#
# Example:    ALL: some.host.name, .some.domain
#             ALL EXCEPT in.fingerd: other.host.name, .other.domain
#
# If you're going to protect the portmapper use the name "portmap" for the
# daemon name. Remember that you can only use the keyword "ALL" and IP
# addresses (NOT host or domain names) for the portmapper, as well as for
# rpc.mountd (the NFS mount daemon). See portmap(8) and rpc.mountd(8)
# for further information.
#
# The PARANOID wildcard matches any host whose name does not match its
# address.
#
# You may wish to enable this to ensure any programs that don't
# validate looked up hostnames still leave understandable logs. In past
# versions of Debian this has been the default.
# ALL: PARANOID
"/etc/hosts.deny" 20L, 880C

# /etc/hosts.allow: list of hosts that are allowed to access the system.
#                   See the manual pages hosts_access(5) and hosts_options(5).
#
# Example:    ALL: LOCAL @some_netgroup
#             ALL: .foobar.edu EXCEPT terminalserver.foobar.edu
#
# If you're going to protect the portmapper use the name "portmap" for the
# daemon name. Remember that you can only use the keyword "ALL" and IP
# addresses (NOT host or domain names) for the portmapper, as well as for
# rpc.mountd (the NFS mount daemon). See portmap(8) and rpc.mountd(8)
# for further information.
#
chargen : 192.168.30.128/26 : allow
echo : ALL : allow
ALL : 127.0.0.1 : allow
ALL : ALL : deny
"/etc/hosts.allow" 16L, 675C

# addresses (NOT host or domain names) for the portmapper, as well as for
# rpc.mountd (the NFS mount daemon). See portmap(8) and rpc.mountd(8)
# for further information.
#
# The PARANOID wildcard matches any host whose name does not match its
# address.
#/etc/hosts.deny" 20L, 880C
# You may wish to enable this to ensure any programs that don't
# validate looked up hostnames still leave understandable logs. In past
# versions of Debian this has been the default.
# ALL: PARANOID

# /etc/hosts.allow: list of hosts that are allowed to access the system.°Ñ€Ð¸Ð°Ð½Ñ‚а одного и того же файла.
#
# Example:    ALL: LOCAL @some_netgroup
#             ALL: .foobar.edu EXCEPT terminalserver.foobar.edu
#
# If you're going to protect the portmapper use the name "portmap" for the¾ файла завершён аварийно.
# daemon name. Remember that you can only use the keyword "ALL" and IPrecover" или "vim -r /etc/hosts.allow"
# addresses (NOT host or d
#
chargen : 192.168.30.128/26 : allow
echo : ALL : allow
ssh : ALL : allowormation.
    чтобы избежать появления этого сообщения в будущем.
Своп-файл "/etc/.hosts.allow.swp" уже существует!
[O] Открыть для чтения, (E) Редактировать, (R) Восстановить, (Q) Выход, (A) Пре
                                                                               р
"/etc/hosts.allow" [только для чтения] 17L, 693C

Stopping internet superserver: xinetd.
Starting internet superserver: xinetd failed!

#tail /var/log/d

daemon.log  debug       dmesg       dmesg.0     dmesg.1.gz  dmesg.2.gz  dmesg.3.gz  dmesg.4.gz  dpkg.log

Dec 13 16:13:38 debian2 xinetd[1023]: removing discard
Dec 13 16:13:38 debian2 xinetd[1023]: removing discard
Dec 13 16:13:38 debian2 xinetd[1023]: removing echo
Dec 13 16:13:38 debian2 xinetd[1023]: removing time
Dec 13 16:13:38 debian2 xinetd[1023]: Swapping defaults
Dec 13 16:13:38 debian2 xinetd[1023]: readjusting service chargen-stream
Dec 13 16:13:38 debian2 xinetd[1023]: readjusting service echo-stream
Dec 13 16:13:38 debian2 xinetd[1023]: readjusting service time-stream
Dec 13 16:13:38 debian2 xinetd[1023]: Reconfigured: new=0 old=3 dropped=0 (services)
Dec 13 16:13:52 debian2 xinetd[1023]: Exiting...

Dec 13 15:30:38 debian2 kernel: [   12.350069] processor LNXCPU:00: registered as cooling_device0
Dec 13 15:30:38 debian2 kernel: [   13.351252] parport_pc 00:0b: reported by Plug and Play ACPI
Dec 13 15:30:38 debian2 kernel: [   13.353425] parport0: PC-style at 0x378, irq 7 [PCSPP,TRISTATE]
Dec 13 15:30:38 debian2 kernel: [   14.341646] input: PC Speaker as /devices/platform/pcspkr/input/input4
Dec 13 15:30:38 debian2 kernel: [   15.761117] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input5
Dec 13 15:30:38 debian2 kernel: [   18.734353] Adding 688120k swap on /dev/sda5.  Priority:-1 extents:1 across:688120k
Dec 13 15:30:38 debian2 kernel: [   19.278940] EXT3 FS on sda1, internal journal
Dec 13 15:30:38 debian2 kernel: [   20.222925] loop: module loaded
Dec 13 15:30:38 debian2 kernel: [   27.285903] eth1: link up, 100Mbps, full-duplex, lpa 0x05E1
Dec 13 15:30:38 debian2 kernel: [   28.378184] eth2: link up, 100Mbps, full-duplex, lpa 0x05E1

bootpc          68/tcp                          # BOOTP client
bootpc          68/udp
tftp            69/udp
gopher          70/tcp                          # Internet Gopher
gopher          70/udp
rje             77/tcp          netrjs
finger          79/tcp
www             80/tcp          http            # WorldWideWeb HTTP
www             80/udp                          # HyperText Transfer Protocol
link            87/tcp          ttylink
kerberos        88/tcp          kerberos5 krb5 kerberos-sec     # Kerberos v5
                                                              60,1           6%

root      1909  0.0  0.1   2500   864 ?        S    15:52   0:00 (xinetd service)  chargen -stream 192.168.30. 129
root      2662  0.1  0.4   6448  2388 pts/1    S+   16:21   0:00 /usr/bin/vim /etc/xinetd.conf
root      2664  0.0  0.1   3880   776 pts/2    S+   16:22   0:00 grep xinetd

11/12/13@15:52:28: START: chargen-stream pid=1909 from=192.168.30.129
11/12/13@15:54:53: START: echo-stream pid=2001 from=127.0.0.1
11/12/13@16:03:16: FAIL: time-stream libwrap from=192.168.30.65
11/12/13@16:03:25: START: echo-stream pid=2027 from=192.168.30.65
11/12/13@16:09:23: START: chargen-stream pid=2067 from=192.168.30.65
11/12/13@16:09:23: FAIL: chargen-stream libwrap from=192.168.30.65
11/12/13@16:09:23: START: echo-stream pid=2068 from=192.168.30.65
11/12/13@16:09:26: START: chargen-stream pid=2070 from=192.168.30.65
11/12/13@16:09:26: FAIL: chargen-stream libwrap from=192.168.30.65
11/12/13@16:09:26: START: echo-stream pid=2071 from=192.168.30.65

11/12/13@15:34:22: START: chargen-stream pid=1467 from=127.0.0.1
11/12/13@15:46:24: START: chargen-stream pid=1761 from=127.0.0.1
11/12/13@15:47:17: START: echo-stream pid=1770 from=127.0.0.1
11/12/13@15:47:45: START: time-stream pid=0 from=127.0.0.1
11/12/13@15:50:00: START: chargen-stream pid=1881 from=192.168.30.129
11/12/13@15:50:00: FAIL: chargen-stream libwrap from=192.168.30.129
11/12/13@15:50:11: START: chargen-stream pid=1883 from=192.168.30.129
11/12/13@15:50:11: FAIL: chargen-stream libwrap from=192.168.30.129
11/12/13@15:52:28: START: chargen-stream pid=1909 from=192.168.30.129
11/12/13@15:54:53: START: echo-stream pid=2001 from=127.0.0.1
11/12/13@16:03:16: FAIL: time-stream libwrap from=192.168.30.65
11/12/13@16:03:25: START: echo-stream pid=2027 from=192.168.30.65
11/12/13@16:09:23: START: chargen-stream pid=2067 from=192.168.30.65
11/12/13@16:09:23: FAIL: chargen-stream libwrap from=192.168.30.65
11/12/13@16:09:23: START: echo-stream pid=2068 from=192.168.30.65
11/12/13@16:09:26: START: chargen-stream pid=2070 from=192.168.30.65
11/12/13@16:09:26: FAIL: chargen-stream libwrap from=192.168.30.65
11/12/13@16:09:26: START: echo-stream pid=2071 from=192.168.30.65

--- /tmp/l3-saved-1298.27610.14625	2011-12-13 16:25:10.000000000 +0200
+++ /etc/xinetd.d/chargen	2011-12-13 16:25:48.000000000 +0200
@@ -6,7 +6,7 @@
 # This is the tcp version.
 service chargen
 {
-	disable		= yes
+	disable		= no
 	type		= INTERNAL
 	id		= chargen-stream
 	socket_type	= stream
@@ -16,13 +16,3 @@
 }                                                                               
 
 # This is the udp version.
-service chargen
-{
-	disable		= no
-	type		= INTERNAL
-	id		= chargen-stream
-	socket_type	= stream
-	protocol	= tcp
-	user		= root
-	wait		= no
-}                                                                               

chargen  daytime  discard  echo  time

# This file generated by xconv.pl, included with the xinetd
# package.  xconv.pl was written by Rob Braun (bbraun@synack.net)
#
# The file is merely a translation of your inetd.conf file into
# the equivalent in xinetd.conf syntax.  xinetd has many
# features that may not be taken advantage of with this translation.
# Please refer to the xinetd.conf man page for more information
        #The maximum number of requests a particular service may handle
# on ho # at once.ly configure xinetd.
        instances   = 25
...
        # DURATION logs the duration of the session.
        log_on_success = HOST PID
        # What to log when the connection fails.  Same options as above
        log_on_failure = HOST
        # The maximum number of connections a specific IP address can
        # have to a specific service.
        per_source  = 5
}
includedir /etc/xinetd.d
"/etc/xinetd.conf" 37L, 1300C

--- /tmp/l3-saved-3303.26170.8293	2011-12-13 16:30:42.000000000 +0200
+++ /etc/xinetd.conf	2011-12-13 16:31:00.000000000 +0200
@@ -34,4 +34,4 @@
 	# have to a specific service.  
 	per_source  = 5
 }
-includedir /etc/xinetd.d
+includedir /etc/xinetd.d/

Starting Nmap 5.00 ( http://nmap.org ) at 2011-12-13 16:36 EET
Interesting ports on localhost.localdomain (127.0.0.1):
Not shown: 994 closed ports
PORT    STATE SERVICE
7/tcp   open  echo
19/tcp  open  chargen
22/tcp  open  ssh
25/tcp  open  smtp
37/tcp  open  time
111/tcp open  rpcbind
Nmap done: 1 IP address (1 host up) scanned in 0.98 seconds

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:19              0.0.0.0:*               LISTEN      1066/xinetd
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1015/sshd
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1243/exim4
tcp        0      0 0.0.0.0:39619           0.0.0.0:*               LISTEN      758/rpc.statd
tcp        0      0 0.0.0.0:37              0.0.0.0:*               LISTEN      1066/xinetd
tcp        0      0 0.0.0.0:7               0.0.0.0:*               LISTEN      1066/xinetd
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      746/portmap
udp        0      0 0.0.0.0:111             0.0.0.0:*                           746/portmap
udp        0      0 0.0.0.0:49806           0.0.0.0:*                           758/rpc.statd
udp        0      0 0.0.0.0:934             0.0.0.0:*                           758/rpc.statd

Stopping internet superserver: xinetd.
Starting internet superserver: xinetd.

Starting Nmap 5.00 ( http://nmap.org ) at 2011-12-13 16:46 EET
NSE: Loaded 0 scripts for scanning.
Initiating SYN Stealth Scan at 16:46
Scanning localhost.localdomain (127.0.0.1) [1000 ports]
Discovered open port 22/tcp on 127.0.0.1
Discovered open port 111/tcp on 127.0.0.1
Discovered open port 25/tcp on 127.0.0.1
Discovered open port 7/tcp on 127.0.0.1
Discovered open port 19/tcp on 127.0.0.1
Discovered open port 37/tcp on 127.0.0.1
...
PORT    STATE SERVICE
7/tcp   open  echo
19/tcp  open  chargen
22/tcp  open  ssh
25/tcp  open  smtp
37/tcp  open  time
111/tcp open  rpcbind
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.30 seconds
           Raw packets sent: 1000 (44.000KB) | Rcvd: 2006 (84.264KB)

Starting Nmap 5.00 ( http://nmap.org ) at 2011-12-13 16:47 EET
Interesting ports on localhost.localdomain (127.0.0.1):
Not shown: 994 closed ports
PORT    STATE SERVICE VERSION
7/tcp   open  echo
19/tcp  open  chargen Linux chargen
22/tcp  open  ssh     OpenSSH 5.5p1 Debian 6 (protocol 2.0)
25/tcp  open  smtp    Exim smtpd 4.72
37/tcp  open  time?
111/tcp open  rpcbind
...
SF:\xe4\0")%r(SSLSessionReq,4,"\xd2\x91\xe4\0")%r(SMBProgNeg,4,"\xd2\x91\x
SF:e4\0")%r(X11Probe,4,"\xd2\x91\xe4\0")%r(FourOhFourRequest,4,"\xd2\x91\x
SF:e4\0")%r(LPDString,4,"\xd2\x91\xe4\0")%r(LDAPBindReq,4,"\xd2\x91\xe4\0"
SF:)%r(SIPOptions,4,"\xd2\x91\xe4\0")%r(LANDesk-RC,4,"\xd2\x91\xe4\0")%r(T
SF:erminalServer,4,"\xd2\x91\xe4\0")%r(NCP,4,"\xd2\x91\xe4\0")%r(NotesRPC,
SF:4,"\xd2\x91\xe4\0")%r(WMSRequest,4,"\xd2\x91\xe4\0")%r(oracle-tns,4,"\x
SF:d2\x91\xe4\0");
Service Info: Host: debian2.net.nt; OS: Linux
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.41 seconds

PING 192.168.30.62 (192.168.30.62) 56(84) bytes of data.
64 bytes from 192.168.30.62: icmp_req=1 ttl=63 time=4.04 ms
64 bytes from 192.168.30.62: icmp_req=2 ttl=63 time=3.15 ms
^C
--- 192.168.30.62 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 3.152/3.600/4.049/0.452 ms

PING 192.168.30.1 (192.168.30.1) 56(84) bytes of data.
64 bytes from 192.168.30.1: icmp_req=1 ttl=62 time=3.44 ms
^C
--- 192.168.30.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 3.440/3.440/3.440/0.000 ms

Starting Nmap 5.00 ( http://nmap.org ) at 2011-12-14 10:22 EET
Interesting ports on 192.168.30.1:
Not shown: 996 closed ports
PORT    STATE SERVICE
19/tcp  open  chargen
21/tcp  open  ftp
22/tcp  open  ssh
111/tcp open  rpcbind
Nmap done: 1 IP address (1 host up) scanned in 3.04 seconds

©´•±?Ž&ôË®û–ͺÔÄ£!s¯êÊÁŒ¼öíÊÜ0j»IR’
                ÆF yþc^*91|žìdQ–Þ(câhú‚˜f!²åWNWKþV”Îk)Õ&ÏáÜ(
‚d1/Y‡\ÕíËÉH5˜á„„NŽõ]œV˜¿ûã                                 >Ò¡µÎðf­4å¶77NQ£Ú'O0
                                                                                 )¼gLŒ>£CæøV    0BËû¤‰Gò¼zÖäoÛ ‘²åŠ%–rÛ·Êô„÷NµOê*>6¦øt‘è
æ¼6¼ûO‹©5¥XÄó\ÄacD_¥¨ö‘Ïoò;¯    ×vüœ{Ÿ^”°Ón7`´
îM£oxÒº*Ï£#c‹#)ešÊ¨s8¬ûr4øYÀ”‘…~€@™HžÙÀ€«˜ˆ_{Àú?ç]'Uçc‘×8„¬ˆÆ»Â„³kðXÉbVi$ə۫¾Z"˜Cñ ˜€ºŠcì4ª7†ÚŸ’^6W]òWGû%†.Bùꦎ·‹(b–ÉâM©´Yfò¼9M
                           {Ù±J †I<MTOådcôl± 9tË;@jcÅ– æàW2&ïŒ.¹ôG>dC¼Ò:7ƒ'$Š¾!æ[<§Qy8o)íZþ®”‰ˆ²‡]A
áb[{êdwh|
                           —¦
                             þWa)³puãr¿.íìÔGü~`7ïz8¤Dóæ¡NœêßC{"<ª÷ÜÂt¿d$ÓcMîiÜó>ºM(
...
                                                                                                                            АÞê4 0àÂa0—$ôÞx¨¤ÄċÎ@ºÓ ”YväêêÌRxúQ!ŒAŠwÔ        é´F’×d½kI0t–Á%×?D¬£‘BÇ&ÈÕh½hۀ4Ê¡:ÉÖê8O•kŽyTmð\T؎„EâãA.±a¿_‡-†ßݖ^ÚÓæYí‡n"сMC„B°ãò魕}ÕEHýS•ƒÏ}»]ò?žÐVˆÆR
        z>ôW3 dl؝4
                   fFeîÛ~6ªÁ
E-rô¢.­€CÈê¸@êùٖ/‰ù/~      À,dÅâ$®õÛ`˜ŽÇ-ì€c[Š±ÍÎNX—ZÞJ­Hè‚ÌœH:Z;LôSN4»õ¥”2¦¢èZŠ^
                      )ã=¢kËášÅ&
CWU.vfóLiWb¹BR€VA¿'Z_Ÿk9.[¦S҈úd¬•ùü‘<VZÌ-Kå)­û‡ß?I­Ý§>”c·Ýœ3k
Cµœ:ª Ã֖D„$·jÀË¬aÌl¿OP=Gœá—²š“Ó儎—¤Çøg/ʆÒ0ò8Ðvô´qHì6³j’ôXGaÜ£ëò{Óï¢øêSõ7É$³)¼çCžW§*þ¢ãç$GÉå«
                                                                                                 ’³atð
                                                                                                      ¿M¡Ž7GtÆß$®ù«!ÒTŽ>0‹j呩†Si;q1þ]|T•ÏïqäÓêcƒA`WÓ'8óÏZ†d—þµ        §ï9œgºãÈ">~‡'µÈR¤Ïžrœá ¾#"Jr<AÔZ]ôhTŠ!2"µé[±à‚îdc½2 ׿RôV7gUN«„tã_”Çԇá]ˆ)QnϚ„˜¹+”Ü™Étœ$ÀÙ*×W£hÒ§Â
                                                                                                                                                                                                                                                                                ‰ŽÜ+ò̐Ü0Ú{7¢±È{ÉvÜȂHðUþ? ŸTˆu6ÖU×i䶓Ù)É´W¡šÇ:¼¾Ï‹½¹Ûý)Ú!ýÐ)6JM`1íс«y…؝&ðžïš¾ñ¾·z1nH8(÷ÈÔ ²¬¢‰ª¶˜¸‡u¡½D´*Êá’H‰ZÁ¶VýŽ…Œþ:c©Øø

NMAP(1)                                       Nmap Reference Guide                                       NMAP(1)
NAME
       nmap - Network exploration tool and security / port scanner
SYNOPSIS
       nmap [Scan Type...] [Options] {target specification}
DESCRIPTION
       Nmap (“Network Mapper”) is an open source tool for network exploration and security auditing. It was
       designed to rapidly scan large networks, although it works fine against single hosts. Nmap uses raw IP
       packets in novel ways to determine what hosts are available on the network, what services (application
       name and version) those hosts are offering, what operating systems (and OS versions) they are running,
...
           http://www.openssl.org
       25. Lua programming language
           http://www.lua.org
       26. Export Administration Regulations (EAR)
           http://www.access.gpo.gov/bis/ear/ear_data.html
       27. 5D002
           http://www.access.gpo.gov/bis/ear/pdf/ccl5-pt2.pdf
       28. EAR 740.13(e)
           http://www.access.gpo.gov/bis/ear/pdf/740.pdf
Nmap                                               06/24/2009                                            NMAP(1)

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
192.168.30.192  *               255.255.255.192 U         0 0          0 eth2
192.168.30.128  *               255.255.255.192 U         0 0          0 eth1
default         192.168.30.129  0.0.0.0         UG        0 0          0 eth1

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 *:chargen               *:*                     LISTEN      1417/xinetd
tcp        0      0 *:ssh                   *:*                     LISTEN      1015/sshd
tcp        0      0 localhost.localdom:smtp *:*                     LISTEN      1243/exim4
tcp        0      0 *:39619                 *:*                     LISTEN      758/rpc.statd
tcp        0      0 *:time                  *:*                     LISTEN      1417/xinetd
tcp        0      0 *:echo                  *:*                     LISTEN      1417/xinetd
tcp        0      0 *:sunrpc                *:*                     LISTEN      746/portmap
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN      1015/sshd
tcp6       0      0 ::1%3214130728:smtp     [::]:*                  LISTEN      1243/exim4
udp        0      0 *:sunrpc                *:*                                 746/portmap
udp        0      0 *:49806                 *:*                                 758/rpc.statd
udp        0      0 *:934                   *:*                                 758/rpc.statd
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node   PID/Program name    Path
unix  2      [ ACC ]     STREAM     LISTENING     3388     931/acpid           /var/run/acpid.socket

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 *:chargen               *:*                     LISTEN      1417/xinetd
tcp        0      0 *:ssh                   *:*                     LISTEN      1015/sshd
tcp        0      0 localhost.localdom:smtp *:*                     LISTEN      1243/exim4
tcp        0      0 *:39619                 *:*                     LISTEN      758/rpc.statd
tcp        0      0 *:time                  *:*                     LISTEN      1417/xinetd
tcp        0      0 *:echo                  *:*                     LISTEN      1417/xinetd
tcp        0      0 *:sunrpc                *:*                     LISTEN      746/portmap
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN      1015/sshd
tcp6       0      0 ::1%3213913304:smtp     [::]:*                  LISTEN      1243/exim4
udp        0      0 *:sunrpc                *:*                                 746/portmap
udp        0      0 *:49806                 *:*                                 758/rpc.statd
udp        0      0 *:934                   *:*                                 758/rpc.statd
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node   PID/Program name    Path
unix  2      [ ACC ]     STREAM     LISTENING     3388     931/acpid           /var/run/acpid.socket

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:19              0.0.0.0:*               LISTEN      1417/xinetd
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1015/sshd
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1243/exim4
tcp        0      0 0.0.0.0:39619           0.0.0.0:*               LISTEN      758/rpc.statd
tcp        0      0 0.0.0.0:37              0.0.0.0:*               LISTEN      1417/xinetd
tcp        0      0 0.0.0.0:7               0.0.0.0:*               LISTEN      1417/xinetd
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      746/portmap
tcp6       0      0 :::22                   :::*                    LISTEN      1015/sshd
tcp6       0      0 ::1:25                  :::*                    LISTEN      1243/exim4
udp        0      0 0.0.0.0:111             0.0.0.0:*                           746/portmap
udp        0      0 0.0.0.0:49806           0.0.0.0:*                           758/rpc.statd
udp        0      0 0.0.0.0:934             0.0.0.0:*                           758/rpc.statd
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node   PID/Program name    Path
unix  2      [ ACC ]     STREAM     LISTENING     3388     931/acpid           /var/run/acpid.socket

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:19              0.0.0.0:*               LISTEN      1417/xinetd
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1015/sshd
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1243/exim4
tcp        0      0 0.0.0.0:39619           0.0.0.0:*               LISTEN      758/rpc.statd
tcp        0      0 0.0.0.0:37              0.0.0.0:*               LISTEN      1417/xinetd
tcp        0      0 0.0.0.0:7               0.0.0.0:*               LISTEN      1417/xinetd
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      746/portmap
udp        0      0 0.0.0.0:111             0.0.0.0:*                           746/portmap
udp        0      0 0.0.0.0:49806           0.0.0.0:*                           758/rpc.statd
udp        0      0 0.0.0.0:934             0.0.0.0:*                           758/rpc.statd

Kernel Interface table
Iface   MTU Met   RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
eth1       1500 0     30726      0     32 0         29980      0      0      0 BMRU
eth2       1500 0         0      0      0 0             6      0      0      0 BMRU
lo        16436 0      6288      0      0 0          6288      0      0      0 LRU

apt 0.8.10.3 для i386 скомпилирован Apr 15 2011 21:02:20
Использование: apt-get [параметры] команда
               apt-get [параметры] install|remove пакет1 [пакет2 ...]
               apt-get [параметры] source пакет1 [пакет2 ...]
apt-get -- простая программа с интерфейсом командной строки
для скачивания и установки пакетов. Наиболее часто используемые
команды -- update и install.
Команды:
   update -  получить новые списки пакетов
   upgrade - выполнить обновление
...
  -m   попытаться продолжить, даже если архивы не найдены
  -u   показывать также список обновляемых пакетов
  -b   собрать пакет из исходного кода после его получения
  -V   показывать полные номера версий
  -c=? читать указанный файл настройки
  -o=? задать значение произвольному параметру настройки,
       например, -o dir::cache=/tmp
В справочных страницах apt-get(8), sources.list(5) и apt.conf(5)
содержится подробная информация и описание параметров.
                       В APT есть коровья СУПЕРСИÐ

#apt-get install tcpd

tcpd     tcpdump

Чтение списков пакетов... Готово
Построение дерева зависимостей
Чтение информации о состоянии... Готово
НОВЫЕ пакеты, которые будут установлены:
  tcpdump
обновлено 0, установлено 1 новых пакетов, для удаления отмечено 0 пакетов, и 38 пакетов не обновлено.
Необходимо скачать 376 kБ архивов.
После данной операции, объём занятого дискового пространства возрастёт на 901 kB.
Получено:1 http://ftp.ua.debian.org/debian/ squeeze/main tcpdump i386 4.1.1-1 [376 kB]
Получено 376 kБ за 0с (416 kБ/c)
Выбор ранее не выбранного пакета tcpdump.
(Чтение базы данных ... на данный момент установлено 29596 файлов и каталогов.)
Распаковывается пакет tcpdump (из файла .../tcpdump_4.1.1-1_i386.deb)...
Обрабатываются триггеры для man-db ...
Настраивается пакет tcpdump (4.1.1-1) ...

Чтение списков пакетов... Готово
Построение дерева зависимостей
Чтение информации о состоянии... Готово
НОВЫЕ пакеты, которые будут установлены:
  netdiag
обновлено 0, установлено 1 новых пакетов, для удаления отмечено 0 пакетов, и 38 пакетов не обновлено.
Необходимо скачать 290 kБ архивов.
После данной операции, объём занятого дискового пространства возрастёт на 1 004 kB.
Получено:1 http://ftp.ua.debian.org/debian/ squeeze/main netdiag i386 1.0-13 [290 kB]
Получено 290 kБ за 0с (372 kБ/c)
Предварительная настройка пакетов ...
Выбор ранее не выбранного пакета netdiag.
(Чтение базы данных ... на данный момент установлено 29608 файлов и каталогов.)
Распаковывается пакет netdiag (из файла .../netdiag_1.0-13_i386.deb)...
Обрабатываются триггеры для man-db ...
Настраивается пакет netdiag (1.0-13) ...

#tra

traceproto        traceroute        traceroute6.db    traceroute-nanog  trap
traceproto.db     traceroute6       traceroute.db     trafshow

TRAFSHOW(1)                                                                                          TRAFSHOW(1)
NAME
       trafshow - full screen show network traffic
SYNOPSIS
       trafshow [-vpnb] [-a len] [-c conf] [-i name] [-s str] [-u port] [-R refresh] [-P purge] [-F file | expr]
DESCRIPTION
       TrafShow  is a simple interactive program that gather the network traffic from all libpcap-capable inter‐
       faces to accumulate it in memory cache, and then separately display it on appropriated curses  window  in
       line-narrowed  manner  as  a list of network flows sorted by throughput. Display updates occurs nearly in
       real time, asynchronously from the data collecting. It look like a live show of traffic flows.  Any  kind
...
       iour.
       This program may be found wonderful at lest to locate suspicious traffic  on  the  net  very  quickly  on
       demand, or to evaluate real time traffic bandwidth utilization, in a simplest and convenient environment.
       But it is not intended for collecting and analysis of the network traffic for a long period of time,  nor
       for billing!
       The program pretend to be IPv6 compatible and ready to using, but it is not tested enough. You can define
       INET6 to do so.
OPTIONS
       -v     Print detailed version information and exit.
       -p     Do not put interface(s) into promiscuous mode.

Starting Nmap 5.00 ( http://nmap.org ) at 2011-12-14 11:39 EET
Interesting ports on localhost.localdomain (127.0.0.1):
Not shown: 994 closed ports
PORT    STATE SERVICE
7/tcp   open  echo
19/tcp  open  chargen
22/tcp  open  ssh
25/tcp  open  smtp
37/tcp  open  time
111/tcp open  rpcbind
Nmap done: 1 IP address (1 host up) scanned in 0.28 seconds

Starting Nmap 5.00 ( http://nmap.org ) at 2011-12-14 11:40 EET
Interesting ports on localhost.localdomain (127.0.0.1):
Not shown: 994 closed ports
PORT    STATE SERVICE
7/tcp   open  echo
19/tcp  open  chargen
22/tcp  open  ssh
25/tcp  open  smtp
37/tcp  open  time
111/tcp open  rpcbind
Nmap done: 1 IP address (1 host up) scanned in 0.22 seconds

Trying 127.0.0.1...
Connected to localhost.localdomain.
Escape character is '^]'.
ttttt
ttttt
yyyyy
yyyyy
yyy
yyy
gg
...
zxczxc
zxczxc
zxczxc
zxvzxv
zxvzxv
^[vcvcbv
q
^]
telnet> quit
Connection closed.

Чтение списков пакетов... Готово
Построение дерева зависимостей
Чтение информации о состоянии... Готово
НОВЫЕ пакеты, которые будут установлены:
  iptraf
обновлено 0, установлено 1 новых пакетов, для удаления отмечено 0 пакетов, и 38 пакетов не обновлено.
Необходимо скачать 165 kБ архивов.
После данной операции, объём занятого дискового пространства возрастёт на 741 kB.
Получено:1 http://ftp.ua.debian.org/debian/ squeeze/main iptraf i386 3.0.0-7 [165 kB]
Получено 165 kБ за 0с (470 kБ/c)
Выбор ранее не выбранного пакета iptraf.
(Чтение базы данных ... на данный момент установлено 29642 файла и каталога.)
Распаковывается пакет iptraf (из файла .../iptraf_3.0.0-7_i386.deb)...
Обрабатываются триггеры для man-db ...
Настраивается пакет iptraf (3.0.0-7) ...

Trying 127.0.0.1...
Connected to localhost.localdomain.
Escape character is '^]'.
rrr
rrr
ttt
ttt
yuu
yuu
uuuo
uuuo
^]
telnet> quit
Connection closed.

Чтение списков пакетов... Готово
Построение дерева зависимостей
Чтение информации о состоянии... Готово
Будут установлены следующие дополнительные пакеты:
  dbus defoma fontconfig fontconfig-config hicolor-icon-theme libasound2 libatk1.0-0 libatk1.0-data
  libavahi-client3 libavahi-common-data libavahi-common3 libc-ares2 libcairo2 libcap2-bin libcups2 libdatrie1
  libdbus-1-3 libfont-freetype-perl libfontconfig1 libfontenc1 libglib2.0-0 libglib2.0-data libgtk2.0-0
  libgtk2.0-bin libgtk2.0-common libjack-jackd2-0 libjasper1 libjpeg62 libpango1.0-0 libpango1.0-common
  libpixman-1-0 libpng12-0 libportaudio2 libsmi2ldbl libthai-data libthai0 libtiff4 libxcb-render-util0
  libxcb-render0 libxcomposite1 libxcursor1 libxdamage1 libxfixes3 libxfont1 libxft2 libxi6 libxinerama1
...
Настраивается пакет xfonts-encodings (1:1.0.3-1) ...
Настраивается пакет xfonts-utils (1:7.5+2) ...
Настраивается пакет x-ttcidfont-conf (32) ...
Updating font configuration of x-ttcidfont-conf...
Cleaning up category cmap..
Cleaning up category cid..
Cleaning up category truetype..
Updating category truetype..
Updating category cid..
Updating category cmap..

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

PING 192.168.30.1 (192.168.30.1) 56(84) bytes of data.
64 bytes from 192.168.30.1: icmp_req=1 ttl=62 time=4.91 ms
64 bytes from 192.168.30.1: icmp_req=2 ttl=62 time=4.34 ms
64 bytes from 192.168.30.1: icmp_req=3 ttl=62 time=4.22 ms
^C
--- 192.168.30.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 4.224/4.494/4.919/0.308 ms

PING 192.168.30.129 (192.168.30.129) 56(84) bytes of data.
64 bytes from 192.168.30.129: icmp_req=1 ttl=64 time=6.26 ms
64 bytes from 192.168.30.129: icmp_req=2 ttl=64 time=36.9 ms
^C
--- 192.168.30.129 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 6.265/21.631/36.997/15.366 ms

PING 192.168.30.1 (192.168.30.1) 56(84) bytes of data.
64 bytes from 192.168.30.1: icmp_req=1 ttl=62 time=5.48 ms
64 bytes from 192.168.30.1: icmp_req=2 ttl=62 time=6.30 ms
^C
--- 192.168.30.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 5.481/5.891/6.301/0.410 ms