Re: Port 8081 mystery

[Steven Nixon <lists () dancingmonkey org>]

In addition to the other utilities listed in the replies using the -b  
switch with netstat will also help identify what process has the port  
open.

Steve
On Jan 24, 2007, at 2:09 AM, Alcides wrote:

> Hi WALI,
>
> There are several possibilities for why the port is open.
>
> To analyze this situation, you can try a handy utility "Active Ports"
>
> It's an easy to use tool for Windows NT/2000/XP that enables you to  
> monitor all open TCP and UDP ports on the local computer.
> Active Ports shows corresponding ports to the owning application so  
> you can watch which process has opened which port.
>
> It also displays a local and remote IP address for each connection  
> and allows you to terminate the owning process. It also shows the  
> process IDs.
> Active Ports can help you to detect trojans and other malicious  
> programs.
> Hope this will help you to analyze the situation
>
> Regards,
> Alcides
>
> WALI wrote:
> > HI list...
> > I ran a nmap scan on quite a few machines on my internal subnet  
> > and one port that appears on all those scans, especially the  
> > machines that are still running adequately patched but older  
> > Windows 2000 workstations, is tcp 8081. Though nmap shows this as  
> > blackice-icecap port I do not find any such application running in  
> > task manager neither is this installed.
> > nestat-a just lists this port as 'Listening' and does not list any  
> > application name assigned to it, so why is this port there? Who is  
> > using this? I have ran antivirus scan and spybot checker just to  
> > rule out any malware possibilities.
> > Nessus Scan (tis weeks plugin feed) does not show this port listed  
> > amongst any vulnerability.
> > Here is the nmap output:
> > SuSE101:/home/root # nmap -O 192.168.126.245 --osscan-guess
> > Starting Nmap 4.00 ( http://www.insecure.org/nmap/ ) at 2007-01-23  
> > 11:10 GST
> > Interesting ports on 192.168.126.245:
> > (The 1667 ports scanned but not shown below are in state: closed)
> > PORT     STATE SERVICE
> > 135/tcp  open  msrpc
> > 139/tcp  open  netbios-ssn
> > 445/tcp  open  microsoft-ds
> > 2030/tcp open  device2
> > 8081/tcp open  blackice-icecap
> > Device type: general purpose
> > Running: Microsoft Windows NT/2K/XP
> > OS details: Microsoft Windows 2000 SP4 or XP SP1
> > Nmap finished: 1 IP address (1 host up) scanned in 1.107 seconds