SUMMARY: Network and netstat are broken

I had a machine with a non-functioning network and the netstat commend yielded
errors when invoked without privilege. I erroneously assumed these were related.

The good news: correcting the default router fixed the non-functioning network.

The bad news: turns out the system has been broken into; the MD5 of netstat
and several other programs didn't match any known signature.

My thanks to Vlade, Jonathan V Hays, Thomas Steudten, and Casper Dik for
helping me with this.

-- Jim

> I'm doing some work on someone else's Solaris 7 workstation, and their
> network is broken. The symptoms are that:
>     1) it can't talk to the outside world and the outside world can't talk to it
>     2) running netstat by a mortal user yields (netstat runs fine by root):
>  	 ip open: Permission denied
> 	 can't open mib stream: Bad file number
> I'm assuming that if I solve (2), (1) will get better.
>
> Here's an 'ls -l' of relevant files. The dates and file sizes are missing
> to protect the innocent (actually because I didn't write them down):
>
> -r-xr-sr-x   1 bin      sys        ----- date /bin/netstat
>
> lrwxrwxrwx   1 root     other         -- date /dev/ip -> ../devices/pseudo/clone@0:ip
> crw-rw----   1 root     sys       11,  3 date /devices/pseudo/clone@0:ip
>
> lrwxrwxrwx   1 root     other         -- date /dev/tcp -> ../devices/pseudo/clone@0:tcp
> crw-rw-rw-   1 root     sys       11, 42 date /devices/pseudo/clone@0:tcp
>
> lrwxrwxrwx   1 root     other         -- date /dev/udp -> ../devices/pseudo/clone@0:udp
> crw-rw-rw-   1 root     sys       11, 41 date /devices/pseudo/clone@0:udp
>
> I noticed that the major device numbers (3, 42, 41) on my working Solaris 8
> are the same as the minor numbers on their broken Solaris 7 for the three
> /devices... coincidence?
>
> I searched the archives and yahoogroups, and found several other folks who
> had similar problems in the past and wrote to them; most had problems with
> the ownership or permission bits, which look OK here.  All the standard
> networking files look fine, too.
>
> This is on a low-end Ultra (1 or 2, I think).
_______________________________________________
sunmanagers mailing list
sunmanagers@sunmanagers.org
http://www.sunmanagers.org/mailman/listinfo/sunmanagers