You should look for any connections from IP addresses you don't recognize. While this would be harder for a production system, on a home system it shouldn't be too tough. I would pay particular attention to ftp connections (if you have the service available. As for everything you can look for, that fills books and employs profesionals all with their own opinion. And just so you know, if you have a full time connection and find one day you can't log into your own machine. Turn it off. I have a friend who thought somethign had just gone wrong and needed fixed. Turns out his system had been compromised. If in doubt shut down and remove it from the net. ======= Kirk Wood Cpt.Kirk at 1tree.net
