Very Computer

>I had a telnet session in server.domain.com
>Next AM I saw a broadcast message that the system was shutting
>down.  However, the system referred to was not my server.domain.com,
>since my telnet session was alive and well the next morning.  The

>There is no host on this network by that name
>The host had no FQDN (like dylan.domain.com)
>The syslogs showed nothing
>/var/adm/messages showed nothing
>Absolutely no one was on the console at that time
>What are the possibilities?  
>Any help appreciated

> >I had a telnet session in server.domain.com
> >Next AM I saw a broadcast message that the system was shutting
> >down.  However, the system referred to was not my server.domain.com,
> >since my telnet session was alive and well the next morning.  The

> >There is no host on this network by that name
> >The host had no FQDN (like dylan.domain.com)
> >The syslogs showed nothing
> >/var/adm/messages showed nothing
> >Absolutely no one was on the console at that time
> >What are the possibilities?
> >Any help appreciated

> NFS servers typically broadcast shutdown notices to all the machines that
> have mounted filesystem from them.  Someone on your system may have mounted
> a filesystem from a remote host named Dylan, and never performed a clean
> unmount, so Dylan still thought you had the filesystem mounted and notified
> you that it was shutting down.

> --

> GTE Internetworking, Powered by BBN, Burlington, MA
> *** DON'T SEND TECHNICAL QUESTIONS DIRECTLY TO ME, post them to newsgroups.
> Please DON'T copy followups to me -- I'll assume it wasn't posted to the group.

> hmm looks like a rootkit to me, prolly been hacked into

> Henry

> > >I had a telnet session in server.domain.com
> > >Next AM I saw a broadcast message that the system was shutting
> > >down.  However, the system referred to was not my server.domain.com,
> > >since my telnet session was alive and well the next morning.  The

> > >There is no host on this network by that name
> > >The host had no FQDN (like dylan.domain.com)
> > >The syslogs showed nothing
> > >/var/adm/messages showed nothing
> > >Absolutely no one was on the console at that time
> > >What are the possibilities?
> > >Any help appreciated

> > NFS servers typically broadcast shutdown notices to all the machines that
> > have mounted filesystem from them.  Someone on your system may have mounted
> > a filesystem from a remote host named Dylan, and never performed a clean
> > unmount, so Dylan still thought you had the filesystem mounted and notified
> > you that it was shutting down.

> > --

> > GTE Internetworking, Powered by BBN, Burlington, MA
> > *** DON'T SEND TECHNICAL QUESTIONS DIRECTLY TO ME, post them to newsgroups.
> > Please DON'T copy followups to me -- I'll assume it wasn't posted to the group.

> I am ignorant; please define "rootkit"

> I am ignorant; please define "rootkit"
> TIA

> > hmm looks like a rootkit to me, prolly been hacked into

> > Henry

> > > >I had a telnet session in server.domain.com
> > > >Next AM I saw a broadcast message that the system was shutting
> > > >down.  However, the system referred to was not my server.domain.com,
> > > >since my telnet session was alive and well the next morning.  The

> > > >There is no host on this network by that name
> > > >The host had no FQDN (like dylan.domain.com)
> > > >The syslogs showed nothing
> > > >/var/adm/messages showed nothing
> > > >Absolutely no one was on the console at that time
> > > >What are the possibilities?
> > > >Any help appreciated

> > > NFS servers typically broadcast shutdown notices to all the machines that
> > > have mounted filesystem from them.  Someone on your system may have mounted
> > > a filesystem from a remote host named Dylan, and never performed a clean
> > > unmount, so Dylan still thought you had the filesystem mounted and notified
> > > you that it was shutting down.

> > > --

> > > GTE Internetworking, Powered by BBN, Burlington, MA
> > > *** DON'T SEND TECHNICAL QUESTIONS DIRECTLY TO ME, post them to newsgroups.
> > > Please DON'T copy followups to me -- I'll assume it wasn't posted to the group.

> --

> access to a news server; thanks!
> Disclaimer: opinions expressed my own and not representative of my employers