I find the netstat program to be much more useful and accurate than nmap
when determining what ports are doing what on your system. For example:
# netstat -nlp | grep LISTEN
tcp 0 0 0.0.0.0:515 0.0.0.0:* LISTEN
16891/lpd Waiting
tcp 0 0 192.168.24.1:139 0.0.0.0:* LISTEN
11727/smbd
tcp 0 0 127.0.0.1:139 0.0.0.0:* LISTEN
11727/smbd
tcp 0 0 0.0.0.0:40496 0.0.0.0:* LISTEN
5855/licq
tcp 0 0 0.0.0.0:113 0.0.0.0:* LISTEN
336/oidentd
<snip>
It tells you what IP/port is bound, and the PID and name of the process
using it. On occasion you will find an PID without a process name
attached to it, but you can easily figure this out with a ps list :)
If you start noticing major discrepancies between nmap and netstat
(ex. nmap shows port 666 open but netstat doesn't) you may be in for a bit
of trouble. Rootkits will change system binaries such as netstat, ps, ls,
du, login, etc in order to hide certain processes. If netstat or any
other critical binary has been compromised, then you maybe missing
something in the output. This is a whole other matter, much more serious
than a rogue fingerd ;)
--Henry
On Wed, 7 Feb 2001, Matthias G. Imhof wrote:
> Performing strobe or nmap on my system, I get, e.g., the following list:
>
> 79/tcp open finger
> 119/tcp open nntp
> 143/tcp open imap2
> 540/tcp open uucp
> 6667/tcp open irc
> 12345/tcp open NetBus
> 12346/tcp open NetBus
> 31337/tcp open Elite
>
> However, lsof -i tcp:79 yields nothing. Similarly with the others.
> In addition, there should be no irc running, finger is commented from the
> inetd.conf, and so on.
>
> Why do these ports respond to strobe or nmap? Which process controlls them?
>
> Matthias
>
> --
> **************************************************************************
> * Matthias G.Imhof, Ph.D. phone: (540) 231 6004 *
> * Derring Hall 4044 fax: (540) 231 3386 *
> * Virginia Tech email: [EMAIL PROTECTED] *
> * Blacksburg, VA 24061-0420 http://www.geol.vt.edu/profs/mgi *
> * There is no dark side of the moon really. Matter of fact it's all dark *
> **************************************************************************
>
>
> --
> To UNSUBSCRIBE, email to [EMAIL PROTECTED]
> with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
>
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
