Arch Linux

mangus

Member

From: Bologna, Italy

Registered: 2007-04-07

Posts: 289

[solved]Unknown tcp open random ports

well , if I do  netstat --tcp --udp --listening --program I find:

    Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name   
tcp        0      0 *:26464                 *:*                     LISTEN      6633/skype          
tcp        0      0 *:56480                 *:*                     LISTEN      -                   
tcp        0      0 *:39916                 *:*                     LISTEN      958/rpc.statd       
tcp        0      0 *:sunrpc                *:*                     LISTEN      951/rpcbind         
tcp        0      0 *:cisco-sccp            *:*                     LISTEN      893/freepopsd       
tcp        0      0 tao64.localdomai:domain *:*                     LISTEN      849/pdnsd                     
udp        0      0 *:57647                 *:*                                 -                   
udp        0      0 tao64.localdomain:59904 *:*                                 6633/skype          
udp        0      0 *:olsr                  *:*                                 951/rpcbind         
udp        0      0 *:entrust-ash           *:*                                 958/rpc.statd       
udp        0      0 *:52917                 *:*                                 958/rpc.statd       
udp        0      0 *:26464                 *:*                                 6633/skype          
udp        0      0 tao64.localdomai:domain *:*                                 849/pdnsd           
udp        0      0 *:sunrpc                *:*                                 951/rpcbind         

please note the process with '-' as program name.
Nmap confirm that that ports are opened , and I can't find what process start listening there , I tried with lsof or fuser with no luck
empty answer ,opened  ports seems different on reboot.
Do I need to begin to worry?
Thank you for the hints , Security Masters!

Last edited by mangus (2011-06-26 14:20:36)

R00KIE

Forum Fellow

From: Between a computer and a chair

Registered: 2008-09-14

Posts: 4,734

Re: [solved]Unknown tcp open random ports

Got root?

---

R00KIE
Tm90aGluZyB0byBzZWUgaGVyZSwgbW92ZSBhbG9uZy4K

mangus

Member

From: Bologna, Italy

Registered: 2007-04-07

Posts: 289

Re: [solved]Unknown tcp open random ports

Got root?

invaluable.
anyone else?

Leonid.I

Member

From: Aethyr

Registered: 2009-03-22

Posts: 999

Re: [solved]Unknown tcp open random ports

What do you mean? Run

netstat -atup

as root to see programs which listen on 56480...

---

Arch Linux is more than just GNU/Linux -- it's an adventure
pkill -9 systemd

mangus

Member

From: Bologna, Italy

Registered: 2007-04-07

Posts: 289

Re: [solved]Unknown tcp open random ports

same, the program is '-' , no pid....port changed

tcp        0      0 *:45330                 *:*                     LISTEN      -

sadly , I'm going to reinstall

Last edited by mangus (2011-06-25 17:22:08)

Leonid.I

Member

From: Aethyr

Registered: 2009-03-22

Posts: 999

Re: [solved]Unknown tcp open random ports

Can you try ss?

/usr/sbin/ss -arpt4
/usr/sbin/ss -arpu4

---

Arch Linux is more than just GNU/Linux -- it's an adventure
pkill -9 systemd

mangus

Member

From: Bologna, Italy

Registered: 2007-04-07

Posts: 289

Re: [solved]Unknown tcp open random ports

So, that strange port opening appear when I mount some nfs volumes on my nas , they show up when I mount them..it's seems something related to rpcbind .
rpcinfo -p show them as part of  nlockmgr
I don't understand why netstat fails to track them down properly.