# defunct netstat process

## matthew2k

Hey guys!

In light of the latest news about the gnu ftp being hacked I just started to wonder where this defunct netstat process is coming from I am seeing almost constantly. I mean there is even a defunct netstat process when I didn't even run netstat at all the whole time the computer was on. I have already checked the init scripts if something there makes use of it- no luck at all.

Now I am somewhat afraid that I might have been hacked too- even though it would be kinda strange because my computer is not always on the net, I don't have a static IP... so a hacker wouldn't have much fun trying to hack my box. (not much time for hacking: changing IP adresses and such...)

Does anyone see the same probs on his/her box too? And does anyone have an explanation for this?

Thanks in advance for any clues...!!

 - matthias

----------

## kallamej

I have noticed that one too. Once I tried to find out when I got it. What I found out was that it appeared when I logged in to the Gentoo forum and disappeared when I quit MozillaFirebird. 

But now I don't seem to have it. The only major package I have updated since then is my kernel from gentoo-sources 2.4.20-r5 to -r6. At the same time I also enabled low-level grsecurity. I didn't have any of that before. I'll boot my old kernel to see what happens.

EDIT: Ok booting from 2.4.20-r5 with no grsecurity gives me

```
1800 myusername      16   0     0    0    0 Z  0.0  0.0   0:00.00 netstat <defunct>
```

 The only other difference from before is that I had to use the nv driver this time.

----------

## devon

Perhaps this explains the "<defunct>". From "man ps":

```
Processes marked <defunct> are dead processes (so-called "zombies") that remain because their parent has not destroyed them properly. These processes will be destroyed by init(8) if the parent process exits.
```

----------

## kallamej

I know that. The question to me is why the parent process, in my case MozillaFirebird as far as I can tell, starts it when I log in to these forums. It is back now, btw. But only occasionally.

----------

## Carlo

Yes, found this one too, in Mozilla 1.4 lately.

Carlo

----------

## Xiol

I got this one from Mozilla 1.4 too.

Check it's parent process with ps -A --forest and see what it's parent is.

----------

## smiler.se

I can verify that this one has been in MozillaFirebird for some time. Ive never cared about it really but it would be interessting to know why Mozilla calls netstat   :Exclamation: 

----------

