Why is there a python listening on port 32769?

cwhh · 07-24-2006, 02:19 PM

I used netstat and lsof to find which daemons listening on some ports and found that python is listening on port 32769 although it is a loopback. Anyone knows what that is?

cwh

Matir · 07-24-2006, 03:00 PM

No, though netstat should show the PID of the process, which you can lookup in /proc/<pid>/ to learn more about the process in question.

Penguin of Wonder · 07-24-2006, 09:39 PM

Its nothing to worry about. I once read what this is and why its there, but it slips me at the moment. Alot of firewalls will actually try to ban Python, but its not sending or recieving about you over the internet. Don't block it and don't worry about it.

cwhh · 07-25-2006, 01:33 PM

The ps line of python process indicated /usr/sbin/hpssd
Actually, I installed sarge by default installation. Also, added the following:

desktop environment
alsa and sound-juicer
hplip (it depends on cups, samba)
firestarter firewall
mozilla-firefox and -thunderbird

Probably hpssd belongs to hplip (hp printer driver) I have not checked yet.
If that is the case, hplip might be the culprit.

cwh

Matir · 07-25-2006, 04:47 PM

Code:

dpkg-query -S /usr/sbin/hpssd

Should reveal your culprit.

zapotek · 09-16-2006, 04:45 PM

I have the same problem:
python keeps listening on a random (open!) port. why?!

Code:

# netstat -nlp -A inet
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:4746          0.0.0.0:*               LISTEN      2205/python
tcp        0      0 127.0.0.1:3828          0.0.0.0:*               LISTEN      2193/hpiod
tcp        0      0 0.0.0.0:631             0.0.0.0:*               LISTEN      2285/cupsd
udp        0      0 0.0.0.0:68              0.0.0.0:*                           3537/dhclient
udp        0      0 224.0.1.1:123           0.0.0.0:*                           2955/ntpd
udp        0      0 127.0.0.1:123           0.0.0.0:*                           2955/ntpd
udp        0      0 0.0.0.0:123             0.0.0.0:*                           2955/ntpd

Code:

# nmap -PS/PA/PU -p1-65535 -sV --osscan-guess localhost

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2006-09-17 00:17 EEST
Interesting ports on localhost (127.0.0.1):
Not shown: 65532 closed ports
PORT     STATE SERVICE VERSION
631/tcp  open  ipp     CUPS 1.1
3828/tcp open  hpiod   HP Linux Imaging and Printing System
4746/tcp open  unknown

after a reboot python is listening on other ports

Code:

 # netstat -nlp -A inet
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:4323          0.0.0.0:*               LISTEN      2195/hpiod
tcp        0      0 0.0.0.0:631             0.0.0.0:*               LISTEN      2287/cupsd
tcp        0      0 127.0.0.1:4281          0.0.0.0:*               LISTEN      2207/python
udp        0      0 0.0.0.0:68              0.0.0.0:*                           2496/dhclient
udp        0      0 224.0.1.1:123           0.0.0.0:*                           3341/ntpd
udp        0      0 localhost:123        0.0.0.0:*                           3341/ntpd
udp        0      0 127.0.0.1:123           0.0.0.0:*                           3341/ntpd
udp        0      0 0.0.0.0:123             0.0.0.0:*                           3341/ntpd

Code:

# nmap -PS/PA/PU -p1-65535 -sV --osscan-guess localhost

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2006-09-19 16:52 EEST
Interesting ports on localhost (127.0.0.1):
Not shown: 65532 closed ports
PORT     STATE SERVICE VERSION
631/tcp  open  ipp     CUPS 1.1
4281/tcp open  unknown
4323/tcp open  hpiod   HP Linux Imaging and Printing System

zapotek · 09-22-2006, 03:55 AM

it seems that python is listening on google, and hpiod to 81.196.193.137 (port 80)
here it is:

# netstat -pant
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
PID/Program name
tcp 0 0 127.0.0.1:1127 0.0.0.0:* LISTEN
2206/python
tcp 0 0 0.0.0.0:631 0.0.0.0:* LISTEN 2286/cupsd
tcp 0 0 127.0.0.1:5627 0.0.0.0:* LISTEN 2194/hpiod
tcp 0 0 localhost:4469 81.196.193.137:80 ESTABLISHED 4488/mozilla-firefo
tcp 0 0 localhost:3212 72.14.221.99:80 ESTABLISHED 4488/mozilla-firefo
tcp 0 0 localhost:5209 81.196.193.161:80 ESTABLISHED 4488/mozilla-firefo
tcp 0 0 localhost:3339 72.14.221.147:80 ESTABLISHED 4488/mozilla-firefo
tcp 0 0 localhost:3381 72.14.221.147:80 ESTABLISHED 4488/mozilla-firefo
tcp 0 0 127.0.0.1:5627 127.0.0.1:1233 ESTABLISHED 2194/hpiod
tcp 0 0 127.0.0.1:1233 127.0.0.1:5627 ESTABLISHED 2206/python
tcp 0 0 localhost:5890 72.14.221.104:80 ESTABLISHED 4488/mozilla-firefo
tcp 71804 0 localhost:4229 88.191.28.249:8000 ESTABLISHED 4394/amarokapp

Penguin of Wonder · 09-22-2006, 09:43 AM

Quote:

Originally Posted by Penguin of Wonder

Its nothing to worry about. Don't block it and don't worry about it.

E-mail the Python Foundation if your that concerned.

Matir · 09-22-2006, 10:09 AM

I don't see either python or hpiod touching anything outside your system... both of their lines from netstat indicate loopback connections.

unSpawn · 09-22-2006, 10:55 AM

Open files from running "lsof" on the Python PID could reveal what it's used for.

Its nothing to worry about. I once read what this is and why its there, but it slips me at the moment.
If you don't have a clue, why not skip posting?

Alot of firewalls will actually try to ban Python
W/o a list of FW's that do that and their valid reasons why that statement sounds like male bovine excrement to me. With all due respect, of course.

Penguin of Wonder · 09-22-2006, 08:10 PM

Quote:

Originally Posted by unSpawn

Open files from running "lsof" on the Python PID could reveal what it's used for.

Its nothing to worry about. I once read what this is and why its there, but it slips me at the moment.
If you don't have a clue, why not skip posting?

Alot of firewalls will actually try to ban Python
W/o a list of FW's that do that and their valid reasons why that statement sounds like male bovine excrement to me. With all due respect, of course.

Since you "work" here, I'll spare you the rude reply. :-)

argsv · 10-23-2006, 01:27 AM

thanks for the tips.
I think that belongs to the HP Linux Printing and Imaging System (hpilp) process(es).
After I removed it (since I don't don't to print), the process was gone from netstat.