Just curious but when I do a local port scan I get

22/tcp open ssh
80/tcp open http
111/tcp open sunrpc
885/tcp open unknown
899/tcp open unknown
901/tcp open samba-swat
904/tcp open unknown
908/tcp open unknown
912/tcp open unknown
917/tcp open unknown
918/tcp open unknown
945/tcp open unknown
969/tcp open unknown
971/tcp open unknown
3306/tcp open mysql
6000/tcp open X11


I wonder what the unknowns are and the other funny thing is I cant do a remote port scan on it. I run nmap and it just hangs there forever. I can remotely scan another linux machine I have though. Which doesnt make sense to me.

Thanks

The're unassigned addresses, see the nmap services file for more. Dunno why it would hang waiting for response, but you could play with timeout, -T aggressive for instance.

nmap-services does not have a listing and nmap will run until I cancel it. Also tried many different options I guess my main concern is do you think that it is anything to worry about? After doign a netstat --tcp the foreign address is the same as the local.Could I have some funcky service running that needs those ports?

netstat -anp (or lsof) should give you overview and PID of app running on those ports, run the PID against what you see in "ps ax -eo pid,args" or alike and investigate if the binary is ok/allowed to run.

Thanks for the info that did the trick and it was something that someone previously installed no big deal.

Thanks again.