open ports

jstu · 02-01-2002, 04:23 PM

every once and a while when I run nmap I get a new open port its happened three times. then the port will close like 10 minutes later.The ports are 1400/tcp cadkey-tablet, I dont remeber the other 2 ports but the services where described as coda-srv and netview-aix-5. Does anyone know what these sevices are or atleast offer some kind of lead as to what is going on. I cant find anything on the internet.
Thanks in advance

unSpawn · 02-02-2002, 03:30 AM

Well, depends on where you're looking, try http://www.portsdb.org.

A way I use to locally see what's going on is to use "netstat -an (-A inet)" to see what's opened, and then using "lsof | grep TCP | grep (portnumber) to get the process Id (PID) of the app using that TCP socket, and correlate the PID with "ps ax -eo pid, args" | grep (PID) to show you what app is running using that port.
Ofcourse same goes for UDP or raw, just transmogrify(1) the greppings.

HTH

jstu · 02-02-2002, 02:53 PM

thanks for the info. the other thing that was weird was that mysql had either shutdown or closed its connection because of to many failed connection attempts. I had to run mysqladmin flush -hosts to get it back up.

unSpawn · 02-05-2002, 11:38 AM

If you suspect flooding by fake IP addresses you could add those ranges to your firewall config, or if they're legitimate addresses either to your firewall config and/or hosts.deny

jstu · 02-07-2002, 12:15 AM

ya I just closed all the ports i am not using hopfully that will be fine.
thanks.