open port advice

jak2586 · 03-24-2006, 01:47 PM

hey guys, i ran nmap on myself and found something interesting, wondered if someone could explain it?

before you tell me to google it, i have and found this:

623 tcp aux_bus_shunt Aux Bus Shunt
623 udp aux_bus_shunt Aux Bus Shunt

a unknow service on 623, the only way i can explain it is the connection to my router?

Code:

Interesting ports on localhost (127.0.0.1):
(The 1660 ports scanned but not shown below are in state: closed)
PORT     STATE SERVICE
111/tcp  open  rpcbind
623/tcp  open  unknown
6000/tcp open  X11

also i found this in ps x, mingetty on a google search show me its something to do with "getty" but i dont understand

Code:

 5478 tty1     Ss+    0:00 /sbin/mingetty tty1
 5479 tty2     Ss+    0:00 /sbin/mingetty tty2
 5480 tty3     Ss+    0:00 /sbin/mingetty tty3
 5481 tty4     Ss+    0:00 /sbin/mingetty tty4
 5482 tty5     Ss+    0:00 /sbin/mingetty tty5
 5483 tty6     Ss+    0:00 /sbin/mingetty tty6

thanks in advance

jomen · 03-24-2006, 02:46 PM

the second half: this is the program "mingetty" waiting for input on tty1 ..tty6 - these are your virtual consoles - you reach them by CTRL+ALT+1 ... to ...6
- nothing to worry about.

6000/tcp open X11
- your X server is listening on this port - if you don't need it to - reconfigure the startup-options for it.
If you use a display-manager like gdm you do this in it's configuration file - otherwise via the config-file for the startup script (startx) - I can't be more specific here.
the option you need to add to disable the server listening on that (or any) port is: -nolisten tcp

farslayer · 03-24-2006, 03:50 PM

Quote:

Originally Posted by jak2586

hey guys, i ran nmap on myself and found something interesting, wondered if someone could explain it?

before you tell me to google it, i have and found this:

623 tcp aux_bus_shunt Aux Bus Shunt
623 udp aux_bus_shunt Aux Bus Shunt

a unknow service on 623, the only way i can explain it is the connection to my router?

Code:

Interesting ports on localhost (127.0.0.1):
(The 1660 ports scanned but not shown below are in state: closed)
PORT     STATE SERVICE
623/tcp  open  unknown

netstat -lp | grep 623

This should return the pid/executable name of the application that has the port open.
you can proceed from there.

i.e.

Code:

itg-debian:~# netstat -lnp | grep 22
tcp6       0      0 :::22                   :::*                    LISTEN     3788/sshd

port 22 is being held open by sshd with a processID of 3788
so now I know a bit more about what it is and how to kill it if need be.

jak2586 · 03-24-2006, 04:13 PM

cheers guys, great help!