Strange port usage

From: ASEAN SCHOLAR (kendo1979_at_yahoo.com)
Date: 10/20/04

  • Next message: McDougall, Marshall (FSH): "RE: Installing Apache 2.0 on Redhat Enterprise 2.1?" 
    Date: Wed, 20 Oct 2004 11:04:31 -0700 (PDT)
To: redhat-list@redhat.com

    i'm using linux 2.4.22
    there's strange behaviour in my box
    sometimes when i run netstat -atu
    i get udp 0 0 *:878 *:*
    an another time *:876 or *:875
    i run rpcinfo but none of those ports are listed.
    i run nmap -sU and i get this result " 878/udp open
    unknown "
    how to find out what program/service is using this
    port?
    is this trojan?

    anyone can help?

    thanks

    Robert

                    
    _______________________________
    Do you Yahoo!?
    Declare Yourself - Register online to vote today!
    http://vote.yahoo.com 

    -- 
redhat-list mailing list
unsubscribe mailto:redhat-list-request@redhat.com?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list
  • Next message: McDougall, Marshall (FSH): "RE: Installing Apache 2.0 on Redhat Enterprise 2.1?"

    Relevant Pages

    • Re: hacked?
      ... So I ssh'd in and did a netstat and saw what looked like an unwanted SSH connection... ... On the local host type nmap -sV localhost -p 1-65535 to see what ports respond and which apps/services. ...
      (comp.os.linux.misc)
    • Win2k Netstat sockets interpretation
      ... BUT, netstat /a indicates netbios ports 137,138,139,445 listening when I allow ZA to allow T-bird to act as a server to connect to the ... but Akamaitech~ is frequently there and firefox always has 4 connections local and 4 remote open inaddition to the url i am browsing???? ... The output from Ethereal showed a big download in the background from google...hex and what looks like certificates or host file additions to banks .....I no option to control F.F. updates and like to know when/what is updated since permissions and options have a nasty habit of being reset to 'lame' when updates happen silently ...
      (alt.computer.security)
    • Re: a tool like nestat
      ... netstat -b that will show you the programs associated with the ports in use. ... > a certified computer examiner, learn to recover trace data left behind by ...
      (Security-Basics)
    • Re: Win2k Netstat sockets interpretation
      ... I have deleted "file and print sharing" under "internet connections and disbled most recognizable "remote access" services under 'services.msc' but ZA detects a few remote access modules running and gives them permission if select "OK" to the suggested query. ... notice randomly ports assigned to urls or ip addresss. ... 'netstat' on Win2K provides a view on the state of the *TDI interface*, ... something appearing as 0.0.0.0 listening means "an outstanding request to ...
      (alt.computer.security)
    • Re: ServU-deamon trojan warning with McAfee
      ... This ports showing can also be caused by an issue having to do with our ... This PLAIN and SIMPLE shouldn't happen in an ISA ... Does it matter that something else is ... >> How can I use Netstat to see what's going on? ...
      (microsoft.public.backoffice.smallbiz2000)