what is port 889?

moana · 08-30-2005, 11:39 PM

I wanted to see what ports were open on my local box, and I ran nmap.

this was the result:
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
113/tcp open auth
899/tcp open unknown

what exactly is port 889? also, can i close the rpcbind and auth ports without affecting anything? if anything, i would want to leave SSH's port open.

korozion · 08-31-2005, 12:22 AM

Perhaps run something like netstat -lptn|grep 889 or even ss|grep 889 to see what's running there

moana · 08-31-2005, 12:53 AM

ah, so that's how to find out what that is.... thanks!

# netstat -lptn|grep 899
tcp 0 0 0.0.0.0:899 0.0.0.0:* LISTEN 1141/rpc.statd

now, do i really need this port open?

MensaWater · 08-31-2005, 08:22 AM

Actually in what you just found 1141 is the port in use - 889 is not the port in that line.

Rather than using netstat you should use lsof. It will show you process info for ports unlike netstat which just lets you know which ports are open.

lsof -i :889 (Note the colon) would show you what process has port 889 open.

Also 889 may be defined in your /etc/services file - look for something like udp/889 or tcp/889.

Once you determine what it is you can decide whether it should be open.

MensaWater · 08-31-2005, 08:23 AM

My apologies - I should have said 899 instead of 889 in prior post.

archtoad6 · 08-31-2005, 09:49 AM

Sidebar
How to investigate ports & services

$ less /etc/services
http://www.chebucto.ns.ca/~rakerman/...ble.html#Table esp.
http://www.chebucto.ns.ca/~rakerman/...le.html#search
http://andrew.triumf.ca/cgi-bin/port

Answer ?
Your port 899 (it is 899 not 889, isn't it?) is not assigned by IANA, & I can find no other listed use for it including trojans.

Now you need to check out 'rpc.statd' -- man & Google are your friends. Then ask for clarifications here.