3

First of all, sorry for my english, also is my first question (Dont know what I'm doing :)). I trying to edit my cron job and listing 'my' scheduled tasks i found this one:

*/5 *   *   *   *   perl /usr/bin/hm_fix.pl > /dev/null 2<&1

The script itself:

#!/usr/bin/perl -w
# Script to fix some migrations
$gateway = `netstat \-rn \|grep \^0\.0\.0\.0 \|awk \'\{print \$2\}\'`;
if (($gateway eq "") || ($gateway eq "\n")) {
    exit 1;
}
else {
   `ping -c1 $gateway`; 
}

Looks like its some kind of "network" search or something like that. It is a CentOs 6.5 with Plesk panel installed. I googled script name and found nothing...

Thx a lot for your help.

Dave Cross
  • 68,119
  • 3
  • 51
  • 97
antonrodin
  • 56
  • 4

1 Answers1

3

This is really a shell script which has been written in Perl by someone who didn't know very much Perl :-/

And the comment doesn't really match up with what the program does.

It runs netstat -rn and passes the output through grep to look for the line that starts with 0.0.0.0. It then passes that line through awk '{ print $2 }' to get the IP address of your default gateway.

If this doesn't return an IP address, the program exits with an error status. If it gets an IP address, then it sends a single ping packet to that address and then exits.

Dave Cross
  • 68,119
  • 3
  • 51
  • 97
  • 1
    I couldn't quite figure out if the return code from `ping` would end up going anywhere useful. But otherwise yes, it doesn't actually look like it does very much. – Sobrique Nov 16 '16 at 10:59
  • 5
    @Sobrique It doesn't even display `ping`'s output. It's a badly-written and pointless program. – Dave Cross Nov 16 '16 at 11:03
  • 2
    ping might force an `arp` and that ... I dunno, might do something. – Sobrique Nov 16 '16 at 11:43
  • 1
    @Sobrique Dave, I've seen something like this before... someone had been doing a network migration of servers to another gateway, but instead of polling or honeypotting or sniffing or something of the like, each server pinged a router, then counted the arp cache entries on the router to spot out which servers hadn't been changed over yet. No where near a sane way to do things, but I have seen stranger. – stevieb Nov 16 '16 at 13:54
  • Thx a lot. I think I'll let it be :)) It seems harmless. – antonrodin Nov 17 '16 at 12:54