auditd reports port number '0' for connect() system call

Steve Grubb sgrubb at redhat.com
Wed Mar 30 23:29:58 UTC 2016


On Tuesday, March 29, 2016 11:19:24 PM Kangkook Jee wrote:
> If I understood correctly, connect() should return error when sin_port field
> is set with '0'. Would anyone explain this to me or help me with fix this
> problem?

I get 779 as the port from your event.

-Steve




More information about the Linux-audit mailing list