LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 12-16-2004, 04:47 PM   #1
tallship
Member
 
Registered: Jul 2003
Location: On the Beaches of Super Sunny Southern San Clemente, California USA
Distribution: Slackware - duh!
Posts: 520
Blog Entries: 3

Rep: Reputation: 112Reputation: 112
What is busboy ??? Listening on TCP port 998


k. I setup nfs on a slack 10 box, partly by going over http://nfs.sourceforge.net/nfs-howto/server.html and partly by going over http://www.linuxhelp.ca/guides/nfs/ and partly by going over http://slackware.com/book/index.php?source=x1304.html

Well, nowhere in any of these docs does it say anything about "busboy". Sometimes I see it when I "nmap localhost" and sometimes I don't.

All of my googles only come up with IANA port assignments - I can find no mention anywhere of exactly what busboy is. I track it with lsof, fuser, etc... I can see it's related to portmap and nfs somehow, but I've even done a search through the rfc system itself and rfc1060 rfc1340 and rfc1700 are the only things that come up - again, they only show that busboy listens on TCP port 998.

So...... What is busboy?
 
Old 12-17-2004, 12:34 PM   #2
tallship
Member
 
Registered: Jul 2003
Location: On the Beaches of Super Sunny Southern San Clemente, California USA
Distribution: Slackware - duh!
Posts: 520
Blog Entries: 3

Original Poster
Rep: Reputation: 112Reputation: 112
hm....

It would seem, from the lack of response so far, that not many people actually know what busboy is

Well, in the meantime, I have moved on, to other things, but I'm still interested, and still going to this issue now that it's got my curiosity piqued....

What is busboy
 
Old 12-17-2004, 03:44 PM   #3
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 57
Next time you see it, run the following as root:
netstat -pantu
lsof -i
fuser -n tcp 998 <--this will give you a PID number which you can then lookup in /proc/PID#/cmdline

Hopefully one of those should turn up the identity of the application using that port. For what it's worth, I highly doubt that it's "busboy", older nmap versions just compare the numeric port number to /etc/services and report that as the port name. If I had to gues, I'd say it's probably something related to nfs, like rpc.statd or something related.
 
Old 12-17-2004, 07:59 PM   #4
cormander
Member
 
Registered: Dec 2004
Location: Hawaii
Distribution: Fedora & CentOS
Posts: 72

Rep: Reputation: 15
If you're still not sure what it is after you identify the process, you may want to see what it is doing via strace:

strace -fp PID

-Corey
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
AMaViS not listening on tcp port nutcake Linux - Software 1 09-13-2005 08:44 AM
listening to a usb port fred22 Programming 0 01-11-2005 07:53 PM
NTP listening on UDP+TCP(!)/123 hugohindemith Linux - Networking 4 12-15-2003 10:11 AM
close port 6000/tcp 515/tcp SchwipSchwap Linux - Newbie 1 09-12-2002 08:24 AM
MySQL on Debian 3.0: TCP listening Hko Linux - Software 3 09-04-2002 02:28 PM


All times are GMT -5. The time now is 06:18 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration