On Tue, Mar 30, 2004 at 01:50:02AM +1000, Pearl Louis wrote: > > Netstat could have been compromised though. > nmap says that all ports are closed. If you run something like AIDE as well as chkrootkit as part of your security checking routine, you'll know if your netstat binary has been compromised. regards Andrew