From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: auditd reports port number '0' for connect() system call Date: Fri, 01 Apr 2016 08:13:49 -0400 Message-ID: <18729284.EaRmKyajcD@x2> References: <2356527.JVHcORIXqi@x2> <58B1DB4D-2C44-4A0F-8576-E5AE9E655D05@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: In-Reply-To: <58B1DB4D-2C44-4A0F-8576-E5AE9E655D05@gmail.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Kangkook Jee Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com T24gVGh1cnNkYXksIE1hcmNoIDMxLCAyMDE2IDA2OjExOjI2IFBNIEthbmdrb29rIEplZSB3cm90 ZToKPiBIZXJlIGFuIGV2ZW50IGRpcmVjdGx5IGZyb20gYXVkaXRkIGZvciBjb25uZWN0KCkgc3lz dGVtIGNhbGwgKHN5c2NhbGw9NDIpCj4gd2l0aCBwb3J0IG51bWJlciAwLiBEbyB5b3UgdGhpbmsg Y29ubmVjdCgpIHN5c3RlbSBjYWxsIHN0aWxsIGNhbiBiZSBjYWxsZWQKPiB3aXRoIHBvcnQgbnVt YmVyIDA/CgoKSGVsbG8sCgpJIGdvdCB0aGUgZnVsbCBldmVudHMuIEJlbG93IGlzIHRoZSBleHBs YW5hdGlvbi4uLgoKdHlwZT1TWVNDQUxMIG1zZz1hdWRpdCgwMy8yOS8yMDE2IDIxOjMzOjI3LjE3 ODozNTcyMDA5NCkgOiBhcmNoPXg4Nl82NCAKc3lzY2FsbD1zb2NrZXQgc3VjY2Vzcz15ZXMgZXhp dD00NCBhMD1pbmV0IGExPVNPQ0tfREdSQU0gYTI9aXAgYTM9MHgwIGl0ZW1zPTAgCnBwaWQ9Mjc3 OSBwaWQ9MzE3MTMgYXVpZD11bnNldCB1aWQ9dW5rbm93big4MjcxKSBnaWQ9dW5rbm93big1MDAx KSAKZXVpZD11bmtub3duKDgyNzEpIHN1aWQ9dW5rbm93big4MjcxKSBmc3VpZD11bmtub3duKDgy NzEpIGVnaWQ9dW5rbm93big1MDAxKSAKc2dpZD11bmtub3duKDUwMDEpIGZzZ2lkPXVua25vd24o NTAwMSkgdHR5PShub25lKSBzZXM9dW5zZXQgY29tbT1ETlMgUmVzfmVyIAojNDY1IGV4ZT0vdXNy L2xpYi9maXJlZm94L2ZpcmVmb3gga2V5PShudWxsKSAKClNvLCBoZXJlIF5eXiB3ZSBhcmUgY3Jl YXRpbmcgYSBER1JBTSBzb2NrZXQuIFRoaXMgaXMgaW1wb3J0YW50IGJlY2F1c2UgdGhleSAKZm9s bG93IHNsaWdodGx5IGRpZmZlcmVudCBydWxlcyB0aGFuIHRjcC4KCgp0eXBlPVNPQ0tBRERSIG1z Zz1hdWRpdCgwMy8yOS8yMDE2IDIxOjMzOjI3LjE3ODozNTcyMDA5NSkgOiBzYWRkcj1pbmV0IApo b3N0OjU0LjY4LjEyMi4xMDAgc2VydjowIAp0eXBlPVNZU0NBTEwgbXNnPWF1ZGl0KDAzLzI5LzIw MTYgMjE6MzM6MjcuMTc4OjM1NzIwMDk1KSA6IGFyY2g9eDg2XzY0IApzeXNjYWxsPWNvbm5lY3Qg c3VjY2Vzcz15ZXMgZXhpdD0wIGEwPTB4MmMgYTE9MHg3ZjFmYmU4ZjgxZjAgYTI9MHgxMCBhMz0w eDAgCml0ZW1zPTAgcHBpZD0yNzc5IHBpZD0zMTcxMyBhdWlkPXVuc2V0IHVpZD11bmtub3duKDgy NzEpIGdpZD11bmtub3duKDUwMDEpIApldWlkPXVua25vd24oODI3MSkgc3VpZD11bmtub3duKDgy NzEpIGZzdWlkPXVua25vd24oODI3MSkgZWdpZD11bmtub3duKDUwMDEpIApzZ2lkPXVua25vd24o NTAwMSkgZnNnaWQ9dW5rbm93big1MDAxKSB0dHk9KG5vbmUpIHNlcz11bnNldCBjb21tPUROUyBS ZXN+ZXIgCiM0NjUgZXhlPS91c3IvbGliL2ZpcmVmb3gvZmlyZWZveCBrZXk9KG51bGwpCgoKaHR0 cDovL21hbjcub3JnL2xpbnV4L21hbi1wYWdlcy9tYW4yL2Nvbm5lY3QuMi5odG1sCklmIHRoZSBz b2NrZXQgc29ja2ZkIGlzIG9mIHR5cGUgU09DS19ER1JBTSwgdGhlbiBhZGRyIGlzIHRoZSBhZGRy ZXNzIHRvIHdoaWNoIApkYXRhZ3JhbXMgYXJlIHNlbnQgYnkgZGVmYXVsdCwgYW5kIHRoZSBvbmx5 IGFkZHJlc3MgZnJvbSB3aGljaCBkYXRhZ3JhbXMgYXJlIApyZWNlaXZlZC4KClNvLCB0aGlzIGlz IGp1c3Qgc2V0dGluZyB1cCBhIGNvbm5lY3Rpb25sZXNzIHNvY2tldCB0byBhIHNwZWNpZmljIHNl cnZlci4gCkp1ZGdpbmcgYnkgdGhlIHRocmVhZCBuYW1lLCB0aGlzIGlzIGZvciBETlMgcmVzb2x1 dGlvbiBmb3IgRmlyZWZveC4gU28sIEkgCndvdWxkIHNheSB0aGF0IHdpdGhvdXQgYSBkb3VidCwg dGhpcyBpcyBub3JtYWwgc3lzdGVtIG9wZXJhdGlvbi4KCi1TdGV2ZQoKCj4gdHlwZT1TWVNDQUxM IG1zZz1hdWRpdCgxNDU5MzAxNjA3LjE3ODozNTcyMDA5NSk6IGFyY2g9YzAwMDAwM2Ugc3lzY2Fs bD00Mgo+IHN1Y2Nlc3M9eWVzIGV4aXQ9MCBhMD0yYyBhMT03ZjFmYmU4ZjgxZjAgYTI9MTAgYTM9 MCBpdGVtcz0wIHBwaWQ9Mjc3OQo+IHBpZD0zMTcxMyBhdWlkPTQyOTQ5NjcyOTUgdWlkPTgyNzEg Z2lkPTUwMDEgZXVpZD04MjcxIHN1aWQ9ODI3MSBmc3VpZD04MjcxCj4gZWdpZD01MDAxIHNnaWQ9 NTAwIyB0eXBlPVNPQ0tBRERSIG1zZz1hdWRpdCgxNDU5MzAxNjA3LjE3ODozNTcyMDA5NSk6Cj4g c2FkZHI9MDIwMDAwMDAzNjQ0N0E2NDAwMDAwMDAwMDAwMDAwMDAKPiAKPiBJZiBpdCBpcyBiaW5k KCkgaXQgbWFrZXMgYnV0IEnigJltIG5vdCBzdXJlIHdlIGNhbiBzdGlsbCBkbyB0aGlzIHdpdGgK PiBjb25uZWN0KCkuCj4gCj4gVGhhbmtzIQo+IAo+IC9LYW5na29vawoKCi0tCkxpbnV4LWF1ZGl0 IG1haWxpbmcgbGlzdApMaW51eC1hdWRpdEByZWRoYXQuY29tCmh0dHBzOi8vd3d3LnJlZGhhdC5j b20vbWFpbG1hbi9saXN0aW5mby9saW51eC1hdWRpdA==