techie415 wrote:

If you want to disable port 515, go to file /etc/services and hash out both these lines
printer 515/Tcp spooler
printer 515/udp spooler
That will disable 515
------------------------------------------------------------------------------------------------------
not only did i ### in-front of these lines but i also erased them completely trying to get results. i even went as far as rebooting my system. still getting open port on 515.

thanks for trying to help me solve this problem
AD
====================================================================================================
megaspaz wrote:

hmmm... strange. do you have "lpd" running in your service configuration? i think if you have lpd installed, you'll get lpr. i just tested this and disabling lpd closes port 515 according to nmap.
------------------------------------------------------------------------------------------------------
checking my services i show nothing for lpd or lpr.
other than cups the only other thing i have installed is libgnomeprint for Gnome which i never use I'm a KDE person but its nice to have a back up. i tried to uninstall this but it wanted to take about 50 dependencies with it. I'm going to check into this sometime when its not so late at night.

thanks for your help
AD

Another way to look at whether you really have something listening to port 515 is to do:
If you get a connection refused, don't worry about it, there's nothing there that's going to be a problem for your system. If you get any other response, it *may* tell you what is running. If you get a hang, there's something listening, waiting for a valid response from you (hit Ctrl-C a couple of times to hang up).

i tried to telnet to port 515 with no luck. i turned off both of my firewalls and did a scan of my public ip and 127.0.0.1. the local host shows alot of open ports. maybe im just being anal but why is the local host showing more open ports. i would have guessed they should be the same for my public ip.

thanks,
AD


[joe@www joe]$ telnet localhost 515
Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Connection timed out
[joe@www joe]$



Starting nmap 3.20 ( www.insecure.org/nmap/ ) at 2003-06-21 10:45 PDT
Warning: OS detection will be MUCH less reliable because we did not find at least 1 open and 1 closed TCP port
Interesting ports on xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx (xxxxxxxxxxxxxxxxxx):
(The 1609 ports scanned but not shown below are in state: filtered)
Port State Service
80/tcp open http
515/tcp open printer
Remote OS guesses: SonicWall SOHO firewall, Enterasys Matrix E1, or Accelerated Networks VoDSL, Embedded device: HP Switch, Copper Mountain DSL Concentrator, Compaq Remote Insight Lights-Out remote console card, 3Com Home Wireless Gateway, or TrueTime NTP clock, MegaBit Gear TE4111C, Pigtail Express VoIP phone (runs VxWorks), Brocade Fibre Switch or Sun Remote System Console

Nmap run completed -- 1 IP address (1 host up) scanned in 75.516 seconds




Starting nmap 3.20 ( www.insecure.org/nmap/ ) at 2003-06-21 10:48 PDT
Interesting ports on localhost.localdomain (127.0.0.1):
(The 1605 ports scanned but not shown below are in state: closed)
Port State Service
22/tcp open ssh
80/tcp open http
631/tcp open ipp
783/tcp open hp-alarm-mgr
995/tcp open pop3s
6000/tcp open X11
Remote operating system guess: Linux 2.4.7 (X86)

Nmap run completed -- 1 IP address (1 host up) scanned in 6.774 seconds

Your ISP may be blocking some ports.
Post the output of:
run it as root and hide your public IP address when you post it (change it to XXX.XXX.XXX.XXX, don't change it to all 0s). Put it in "[ code ]" tags so the formatting is preserved.

[joe@localhost joe]$ su
Password:
[root@localhost joe]# netstat -lnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
PID/Program name
tcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN
958/xinetd
tcp 0 0 127.0.0.1:783 0.0.0.0:* LISTEN
976/perl
tcp 0 0 0.0.0.0:6000 0.0.0.0:* LISTEN
1168/X
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN
998/httpd
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
943/sshd
tcp 0 0 0.0.0.0:631 0.0.0.0:* LISTEN
1016/cupsd
udp 0 0 0.0.0.0:68 0.0.0.0:*
824/dhclient
udp 0 0 0.0.0.0:710 0.0.0.0:*
958/xinetd
udp 0 0 0.0.0.0:631 0.0.0.0:*
1016/cupsd
Active UNIX domain sockets (only servers)
Proto RefCnt Flags Type State I-Node PID/Program name Pat
h
unix 2 [ ACC ] STREAM LISTENING 1712 1122/gdm-binary /tm
p/.gdm_socket
unix 2 [ ACC ] STREAM LISTENING 2853 1331/evolution /tm
p/orbit-joe/orb-117610141267548077
unix 2 [ ACC ] STREAM LISTENING 2304 1280/artsd /tm
p/mcop-joe/localhost_localdomain-0500-3ef4ae0c
unix 2 [ ACC ] STREAM LISTENING 1721 1168/X /tm
p/.X11-unix/X0
unix 2 [ ACC ] STREAM LISTENING 1811 1226/ssh-agent /tm
p/ssh-XXLNaPMn/agent.1183
unix 2 [ ACC ] STREAM LISTENING 2202 1266/kdeinit: dcops /tm
p/.ICE-unix/dcop1266-1056222726
unix 2 [ ACC ] STREAM LISTENING 2890 1338/wombat /tm
p/orbit-joe/orb-860087462937298525
unix 2 [ ACC ] STREAM LISTENING 2339 1290/kdeinit: ksmse /tm
p/.ICE-unix/1290
unix 2 [ ACC ] STREAM LISTENING 2225 1269/kdeinit: klaun /tm
p/ksocket-joe/klauncherUkbA9a.slave-socket
unix 2 [ ACC ] STREAM LISTENING 1589 1081/xfs /tm p/.font-unix/fs7100
unix 2 [ ACC ] STREAM LISTENING 2914 1342/bonobo-moniker /tm p/orbit-joe/orb-303228960906492912
unix 2 [ ACC ] STREAM LISTENING 2942 1346/evolution-exec /tm p/orbit-joe/orb-5668911691832791211
unix 2 [ ACC ] STREAM LISTENING 1458 985/gpm /de v/gpmctl
unix 2 [ ACC ] STREAM LISTENING 2965 1350/evolution-cale /tm p/orbit-joe/orb-9667499731607337394
unix 2 [ ACC ] STREAM LISTENING 2992 1355/evolution-alar /tm p/orbit-joe/orb-2013306505241241902
unix 2 [ ACC ] STREAM LISTENING 3028 1361/evolution-addr /tm p/orbit-joe/orb-264383125579549723
unix 2 [ ACC ] STREAM LISTENING 2198 1263/kdeinit: Runni /tm p/ksocket-joe/kdeinit-:0
unix 2 [ ACC ] STREAM LISTENING 2867 1334/oafd /tm p/orbit-joe/orb-7456061691307069854
unix 2 [ ACC ] STREAM LISTENING 3053 1366/evolution-mail /tm p/orbit-joe/orb-5466354631222683457
unix 2 [ ACC ] STREAM LISTENING 3250 1385/gconfd-1 /tm p/orbit-joe/orb-18155779491038652431
[root@localhost joe]#