Security Basics mailing list archives

Unknow process listening on high port


From: Shawn Badger <sbadger () cskauto com>
Date: Tue, 25 Oct 2005 06:33:16 -0700

I have been auditing a couple of my Suse enterprise 9 servers and have
come across a different port on each of them that doesn't show up when I
use lsof, but show up in nmap and netstat. The ports are 39207/tcp on
one server and 49751/tcp on the other. When I do lsof -i -n and grep it
for the proper port I get no output. When I do netstat -ap I get an
output, but the pid shows up as -. I haven't seen a process show up as a
- before and don't where to start looking for that process. Here is the
output of the netstat:
server1:~# netstat -ap |grep 39207

tcp        0      0 *:39207                 *:*
LISTEN -


I get the same results on the other server as well Any ideas would be
appreciated.




Current thread: