k. I setup nfs on a slack 10 box, partly by going over http://nfs.sourceforge.net/nfs-howto/server.html and partly by going over http://www.linuxhelp.ca/guides/nfs/ and partly by going over http://slackware.com/book/index.php?source=x1304.html

Well, nowhere in any of these docs does it say anything about "busboy". Sometimes I see it when I "nmap localhost" and sometimes I don't.

All of my googles only come up with IANA port assignments - I can find no mention anywhere of exactly what busboy is. I track it with lsof, fuser, etc... I can see it's related to portmap and nfs somehow, but I've even done a search through the rfc system itself and rfc1060 rfc1340 and rfc1700 are the only things that come up - again, they only show that busboy listens on TCP port 998.

So...... What is busboy?

hm....

It would seem, from the lack of response so far, that not many people actually know what busboy is

Well, in the meantime, I have moved on, to other things, but I'm still interested, and still going to this issue now that it's got my curiosity piqued....

What is busboy

Next time you see it, run the following as root:
netstat -pantu
lsof -i
fuser -n tcp 998 <--this will give you a PID number which you can then lookup in /proc/PID#/cmdline

Hopefully one of those should turn up the identity of the application using that port. For what it's worth, I highly doubt that it's "busboy", older nmap versions just compare the numeric port number to /etc/services and report that as the port name. If I had to gues, I'd say it's probably something related to nfs, like rpc.statd or something related.

If you're still not sure what it is after you identify the process, you may want to see what it is doing via strace:

strace -fp PID

-Corey