ghost tcp/udp LISTEN ports
- From: "Robert M. Stockmann" <stock@xxxxxxxxxxx>
- Date: Sat, 31 Mar 2007 03:20:07 +0200
After installing a linux box, divx, i came across some weird open
ghost ports :
[divx:root]:(~)# netstat -ltunp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:32769 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 5745/sshd
tcp 0 0 127.0.0.1:6010 0.0.0.0:* LISTEN 5914/0
udp 0 0 0.0.0.0:32768 0.0.0.0:* -
udp 0 0 0.0.0.0:800 0.0.0.0:* -
[divx:root]:(~)# lsof -i TCP:32769
[divx:root]:(~)# lsof -i UDP:32768
[divx:root]:(~)# lsof -i UDP:800
[divx:root]:(~)# lsof -i TCP:22
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
sshd 5745 root 3u IPv4 40365 TCP *:ssh (LISTEN)
sshd 5914 root 3u IPv4 40619 TCP divx.stokkie.net:ssh->jackson.stokkie.net:32913 (
ESTABLISHED)
[divx:root]:(~)# lsof -i TCP:6010
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
sshd 5914 root 6u IPv4 40638 TCP divx.stokkie.net:x11-ssh-offset (LISTEN)
[divx:root]:(~)#
What are these open ports which lsof reports nothing about? The TCP/32769
is for real :
[divx:root]:(~)# telnet divx 32769
Trying 127.0.0.1...
Connected to divx.stokkie.net (127.0.0.1).
Escape character is '^]'.
HELLO?
Connection closed by foreign host.
[divx:root]:(~)#
Anyone?
--
Robert M. Stockmann - RHCE
Network Engineer - UNIX/Linux Specialist
crashrecovery.org stock@xxxxxxxxxxx
.
- Follow-Ups:
- Re: ghost tcp/udp LISTEN ports
- From: Robert M. Stockmann
- Re: ghost tcp/udp LISTEN ports
- Prev by Date: Re: e1000 driver won't load at boot, but loads OK manually. Why?
- Next by Date: Re: Mail disappears between server and email client.
- Previous by thread: IP Tables, SNAT, and routing: selecting the outgoing interface
- Next by thread: Re: ghost tcp/udp LISTEN ports
- Index(es):