[discuss] Re: [OmniOS-discuss] Strange Requests to Fastly

[d <omnios@puptv.com>]

> Thanks...
>
> Both native SmartOS minimal zones, configured with dhcp:
>
> From 10.0.063:  ( a memcached server)
> 12145:  /sbin/init
> 12163:  /lib/svc/bin/svc.startd
>       O_RDWR|O_CLOEXEC  door to svc.startd[12163]
> 12651:  /usr/lib/saf/ttymon -g -d /dev/console -l console -m 
> ldterm,ttcompat -
> 12165:  /lib/svc/bin/svc.configd
>       O_RDWR|O_CLOEXEC  door to svc.configd[12165]
>       O_RDWR|O_CLOEXEC  door to svc.configd[12165]
>       O_RDWR|O_CLOEXEC  door to svc.configd[12165]
>       O_RDWR|O_CLOEXEC  door to svc.configd[12165]
>       O_RDWR|O_CLOEXEC  door to svc.configd[12165]
>       O_RDWR|O_CLOEXEC  door to svc.configd[12165]
> 12212:  /lib/inet/ipmgmtd
>       O_RDWR|O_CLOEXEC  door to ipmgmtd[12212]
> 12303:  /usr/sbin/nscd
>       O_RDWR|O_CLOEXEC  door to nscd[12303]
> 12427:  /usr/lib/pfexecd
>       O_RDWR|O_CLOEXEC  door to pfexecd[12427]
> 12462:  /sbin/dhcpagent
>         sockname: AF_INET 0.0.0.0  port: 68
>         sockname: AF_INET6 ::  port: 546
>         sockname: AF_INET 127.0.0.1  port: 4999
>         sockname: AF_INET 10.0.0.63  port: 68
> 12638:  /usr/sbin/cron
> 12643:  /usr/sbin/rsyslogd -c5 -n
>       O_RDWR|O_CLOEXEC  door to rsyslogd[12643]
> 12646:  /usr/lib/utmpd
> 12681:  /usr/lib/ssh/sshd
>         sockname: AF_INET 0.0.0.0  port: 22
> 29606:  /opt/local/bin/memcached -d -u memcached -l 10.8.9.63 -m 128
>         sockname: AF_INET 10.8.9.63  port: 11211
> 77139:  /usr/bin/login -z global -f root
> 77140:  -bash
> pfiles: cannot examine 77149: no such core file
> pfiles: cannot examine 77150: no such core file
> pfiles: cannot examine 77151: no such core file
>
>
> From 10.0.0.126: (an apache / php server)
> 86793:  /sbin/init
> 86805:  /lib/svc/bin/svc.startd
>       O_RDWR|O_CLOEXEC  door to svc.startd[86805]
> 87270:  /usr/lib/saf/ttymon -g -d /dev/console -l console -m 
> ldterm,ttcompat -
> 86807:  /lib/svc/bin/svc.configd
>       O_RDWR|O_CLOEXEC  door to svc.configd[86807]
>       O_RDWR|O_CLOEXEC  door to svc.configd[86807]
>       O_RDWR|O_CLOEXEC  door to svc.configd[86807]
>       O_RDWR|O_CLOEXEC  door to svc.configd[86807]
>       O_RDWR|O_CLOEXEC  door to svc.configd[86807]
>       O_RDWR|O_CLOEXEC  door to svc.configd[86807]
> 86852:  /lib/inet/ipmgmtd
>       O_RDWR|O_CLOEXEC  door to ipmgmtd[86852]
> 87053:  /usr/lib/pfexecd
>       O_RDWR|O_CLOEXEC  door to pfexecd[87053]
> 87087:  /usr/sbin/nscd
>       O_RDWR|O_CLOEXEC  door to nscd[87087]
> 87096:  /sbin/dhcpagent
>         sockname: AF_INET 0.0.0.0  port: 68
>         sockname: AF_INET6 ::  port: 546
>         sockname: AF_INET 127.0.0.1  port: 4999
>         sockname: AF_INET 10.0.0.126  port: 68
> 87257:  /usr/sbin/cron
> 87267:  /usr/sbin/rsyslogd -c5 -n
>       O_RDWR|O_CLOEXEC  door to rsyslogd[87267]
> 87268:  /usr/lib/utmpd
> 87303:  /usr/lib/ssh/sshd
>         sockname: AF_INET6 ::  port: 22
>         sockname: AF_INET 0.0.0.0  port: 22
> 90079:  /opt/local/sbin/httpd -k start
>         sockname: AF_INET 0.0.0.0  port: 80
> 90080:  /opt/local/sbin/httpd -k start
>         sockname: AF_INET 0.0.0.0  port: 80
> 90081:  /opt/local/sbin/httpd -k start
>         sockname: AF_INET 0.0.0.0  port: 80
> 90082:  /opt/local/sbin/httpd -k start
>         sockname: AF_INET 0.0.0.0  port: 80
> 147:    /usr/bin/login -z global -f root
> 148:    -bash
> 34569:  /usr/bin/login -z global -f root
> 34570:  -bash
> 69932:  snoop -d net0 53
> 69933:  grep -i fastly
> 77408:  /usr/bin/login -z global -f root
> 77409:  -bash
> pfiles: cannot examine 77477: no such core file
> pfiles: cannot examine 77478: no such core file
> pfiles: cannot examine 77479: no such core file
>
>
> Thanks
>
>
>
> On 10/5/24 07:17, Dan McDonald wrote:
>> On Oct 5, 2024, at 10:09 AM, Dan McDonald <danmcd@kebe.com> wrote:
>>> If you zone is native, you can utter this sh/ksh/bash one liner:
>> Do this as root@zone.
>>
>>>        for pid in $(ptree | awk '{print $1}'); do pfiles $pid | 
>>> egrep "$pid|INET"; done
>> You can also do this as root@global by changing "ptree" to "ptree -z 
>> <zonename-or-ZID>".
>>
>> Dan
>>
>>
>> ------------------------------------------
>> illumos: omnios-discuss
>> Permalink: 
>> https://illumos.topicbox.com/groups/omnios-discuss/T7dbdff56e2c887a7-M14321b6725fc4d44f47817b0
>> Delivery options: 
>> https://illumos.topicbox.com/groups/omnios-discuss/subscription

------------------------------------------
illumos: illumos-discuss
Permalink: https://illumos.topicbox.com/groups/discuss/T7dbdff56e2c887a7-Mf1e7f09a78009c062e4eee61
Delivery options: https://illumos.topicbox.com/groups/discuss/subscription