Re: Port 699 listening
On Wed, Dec 14, 2005 at 11:18:29PM -0600, Jeffrey L. Taylor wrote: >Quoting Alex Pankratz <[EMAIL PROTECTED]>: >[snip] >>Did, and that made both 111 and 699 not show up in nmap scan. sweet, >>thanks Jeffery. I could swear that in the past I saw 111 open and I >>sort of ignored it, why would 699 be open now, and then closed? why is >>statd running, i dont use NFS. >> >There are several services that use portmapper. Generally it has to >be ripped out manually after a clean install (at least for Debian and >SuSE). Read the portmap manpage. It tells you about the -i option and tcp_wrapper support. >Jeffrey Aníbal Monsalve Salazar -- .''`. Debian GNU/Linux : :' : Free Operating System `. `' http://debian.org/ `- http://v7w.com/anibal signature.asc Description: Digital signature
Re: Port 699 listening
In article <[EMAIL PROTECTED]> you wrote: > netstat -na | grep 699 > tcp0 0 0.0.0.0:699 0.0.0.0:* LISTEN if you run it as root and use "netstat -lnpo" it will give you the pid and process name of the open listening socket. In some rare cases netstat wont help, then you could use "lsof -i :699" also (as root). Gruss Bernd -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Port 699 listening
Quoting Alex Pankratz <[EMAIL PROTECTED]>: [snip] > Did, and that made both 111 and 699 not show up in nmap scan. sweet, > thanks Jeffery. I could swear that in the past I saw 111 open and I > sort of ignored it, why would 699 be open now, and then closed? why is > statd running, i dont use NFS. > There are several services that use portmapper. Generally it has to be ripped out manually after a clean install (at least for Debian and SuSE). Jeffrey -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Port 699 listening
> See interspersed comments below. My replies interspersed > > Quoting Alex Pankratz <[EMAIL PROTECTED]>: > > My apologies in advance if this is the wrong place to ask this, this > > is my first time asking for help.. > > > > What is running on port 699? I only have squid, ssh, and dhcpd > > listening on my 2 internal interfaces, but nothing on my external one > > (XXX.XXX.XXX.XXX below) > > > > I just ran nmap, and it returned: > > Discovered open port 699/tcp on XXX.XXX.XXX.XXX > > Discovered open port 111/tcp on XXX.XXX.XXX.XXX > > > > And netstat shows: > > netstat -na | grep 699 > > tcp0 0 0.0.0.0:699 0.0.0.0:* LISTEN > > > > Try: lsof -i4 -P | grep 699 rpc.statd 1789root6u IPv42165 TCP *:699 (LISTEN) > > I ran chkrootkit and it returned nothing > > > > Google tells me: > > # Thomas Clausen <[EMAIL PROTECTED]> > > accessnetwork 699/tcpAccess Network > > accessnetwork 699/udpAccess Network > > > > - What is "Access Network"? > > - How can I get RPC to not listen on port 111 at all? > > apt-get --purge remove portmap Did, and that made both 111 and 699 not show up in nmap scan. sweet, thanks Jeffery. I could swear that in the past I saw 111 open and I sort of ignored it, why would 699 be open now, and then closed? why is statd running, i dont use NFS. On a possibly related note, snort is showing me a ton of "SCAN FIN" messages from the same IP, just recently. Also on a possibly related note, could that be the reason why snort is also showing me "(portscan) TCP Portsweep" originating from my external interface? > > or > > invoke-rc.d portmap stop > > > - Do the 0.0.0.0 results for netstat mean all (3) of my ethernet > > interfaces listen for those ports? > > Yes, 0.0.0.0 means all interfaces. > > > > This is a Debian Linux 2.4.27-2-386, and it's been updated/upgraded as > > much as possible, except for the recent kernel update just released. > > > > Your help is appreciated, > > > > Alex > > > > HTH, > Jeffrey > > > -- > To UNSUBSCRIBE, email to [EMAIL PROTECTED] > with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED] > >
Re: Port 699 listening
See interspersed comments below. Quoting Alex Pankratz <[EMAIL PROTECTED]>: > My apologies in advance if this is the wrong place to ask this, this > is my first time asking for help.. > > What is running on port 699? I only have squid, ssh, and dhcpd > listening on my 2 internal interfaces, but nothing on my external one > (XXX.XXX.XXX.XXX below) > > I just ran nmap, and it returned: > Discovered open port 699/tcp on XXX.XXX.XXX.XXX > Discovered open port 111/tcp on XXX.XXX.XXX.XXX > > And netstat shows: > netstat -na | grep 699 > tcp0 0 0.0.0.0:699 0.0.0.0:* LISTEN > Try: lsof -i4 -P | grep 699 > I ran chkrootkit and it returned nothing > > Google tells me: > # Thomas Clausen <[EMAIL PROTECTED]> > accessnetwork 699/tcpAccess Network > accessnetwork 699/udpAccess Network > > - What is "Access Network"? > - How can I get RPC to not listen on port 111 at all? apt-get --purge remove portmap or invoke-rc.d portmap stop > - Do the 0.0.0.0 results for netstat mean all (3) of my ethernet > interfaces listen for those ports? Yes, 0.0.0.0 means all interfaces. > > This is a Debian Linux 2.4.27-2-386, and it's been updated/upgraded as > much as possible, except for the recent kernel update just released. > > Your help is appreciated, > > Alex > HTH, Jeffrey -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
