The Cuckoo's Egg

by Clifford Stoll

“You saw that guy typing in the ps -eafg command, right?” “Yeah, here’s the printout,” I replied. “It’s just an ordinary Unix command to list all the active processes—‘ps’ means print status, and the four letters modify the display. In a sense, they’re like switches on a stereo—they change the way the command works.” “Cliff, I can tell you’re used to Berkeley Unix. Ever since Berkeley Unix was invented, we’ve mechanically typed ‘ps’ to see what’s happening on the system. But tell me, what do those four letters modify?” Dave knew my ignorance of obscure Unix commands. I put up the best front I could: “Well, the e flag means list both the process name and environment, and the a flag lists everyone’s process—not just your process. So the hacker wanted to see everything that was running on the system.” “OK, you got half of ’em. So what are the g and f flags for?” “I dunno.” Dave let me flounder until I admitted ignorance. “You ask for a g listing when you want both interesting and uninteresting processes. All the unimportant jobs, like accounting will show up. As will any hidden processes.” “And we know he’s diddling with the accounting program.” Dave smiled. “So that leaves us with the f flag. And it’s not in any Berkeley Unix. It’s the AT&T Unix way to list each process’s files. Berkeley Unix does this automatically, and doesn’t need the f flag. Our friend doesn’t know Berkeley Unix. He’s from the school of old-fashioned Unix.”