netstat question

divukman · 08-23-2006, 09:38 AM

Hi all.
I'm wondering how can I know the missing pid's?

Code:

# netstat -pat | grep LISTEN
tcp        0      0 *:2049                  *:*                     LISTEN     -                   
tcp        0      0 *:pop3s                 *:*                     LISTEN     2641/dovecot        
tcp        0      0 *:5901                  *:*                     LISTEN     27240/Xtightvnc     
tcp        0      0 *:686                   *:*                     LISTEN     2627/rpc.mountd     
tcp        0      0 *:19150                 *:*                     LISTEN     2582/gkrellmd       
tcp        0      0 *:sunrpc                *:*                     LISTEN     2169/portmap        
tcp        0      0 *:www                   *:*                     LISTEN     2669/apache         
tcp        0      0 *:x11-1                 *:*                     LISTEN     27240/Xtightvnc     
tcp        0      0 *:auth                  *:*                     LISTEN     2591/inetd          
tcp        0      0 *:ftp                   *:*                     LISTEN     2591/inetd          
tcp        0      0 *:smtp                  *:*                     LISTEN     2553/exim4          
tcp        0      0 *:3228                  *:*                     LISTEN     -                   
tcp        0      0 localhost.localdoma:702 *:*                     LISTEN     2646/famd           
tcp6       0      0 localhost:6880          *:*                     LISTEN     6205/java           
tcp6       0      0 *:6881                  *:*                     LISTEN     6205/java           
tcp6       0      0 localhost:45100         *:*                     LISTEN     6205/java           
tcp6       0      0 *:19150                 *:*                     LISTEN     2582/gkrellmd       
tcp6       0      0 *:ssh                   *:*                     LISTEN     2633/sshd           
tcp6       0      0 *:smtp                  *:*                     LISTEN     2553/exim4

unSpawn · 08-23-2006, 10:15 AM

"lsof -lMnP -i tcp:2049" or "fuser -n tcp 2049"?

divukman · 08-23-2006, 10:20 AM

Quote:

Originally Posted by unSpawn

"lsof -lMnP -i tcp:2049" or "fuser -n tcp 2049"?

Code:

[04:40 PM Wed Aug 23][root@starbase]:/home/mito
# lsof -lMnP -i tcp:2049
[04:40 PM Wed Aug 23][root@starbase]:/home/mito
# fuser -n tcp 2049
[04:41 PM Wed Aug 23][root@starbase]:/home/mito
# fuser -n tcp 5901
5901/tcp:            27240

Could it be some residue of a previous process listening on that socket, now hanging ?

AAnarchYY · 08-23-2006, 10:29 AM

after a quick google i found:
port 3228 is a gnutella port
port 2049 is a NFS port

did you try and connect to those ports to look for banners or some type of responce?

divukman · 08-23-2006, 10:35 AM

Quote:

Originally Posted by AAnarchYY

after a quick google i found:
port 3228 is a gnutella port
port 2049 is a NFS port

did you try and connect to those ports to look for banners or some type of responce?

Code:

$ telnet starbase 2049
Trying 192.168.0.185...
Connected to starbase.homenetwork.
Escape character is '^]'.

Same with other port.

ps
I've just found this. Will take a closer look.
http://lists.debian.org/debian-secur.../msg00055.html