ssh371 listening twice

From: rmck (rmckeever_at_earthlink.net)
Date: 09/17/03

  • Next message: Jeff Dickison: "Re: Compile error" 
    Date: Wed, 17 Sep 2003 13:50:37 -0700 (GMT-07:00)
To: secureshell@securityfocus.com

    Hello,

    I am upgrading from openssh 3.5.1 to 3.7.1 on Solaris 8.
    I'm seeing port 22 listening three times with no one connected:

    netstat -an
    v4:
          *.22 *.* 0 0 24576 0 LISTEN
          *.22 *.* 0 0 24576 0 LISTEN
    v6:
          *.22 *.* 0 0
    24576 0 LISTEN

    bash-2.03# lsof | grep ssh | grep LISTEN
    sshd 14957 root 4u IPv6 0x300010aba90 0t0 TCP *:22 (LISTEN)
    sshd 14957 root 5u IPv4 0x30001ab0f68 0t0 TCP *:22 (LISTEN)
    bash-2.03#
    bash-2.03# ps -ef|grep 14957
        root 14957 1 0 15:40:19 ? 0:01 /opt/bin/sshd -f /etc/sshd/sshd_config

    So lsof makes sense, I should see 22 listening twice once for v4 and once for v6.

    But /bin/netstat -an is showing 22 listening twice for version 4. This is what is
    confusing?? Any ideas??

    thanks
    rob

  • Next message: Jeff Dickison: "Re: Compile error"

    Relevant Pages

    • Re: Unknown ports
      ... >> After beginning to learn about security, I ran the following command ... >> lsof | grep LISTEN ... >> So apparently there are two ports listening that have no process or file ... > clearly that you are running a NFS server. ...
      (comp.os.linux.misc)
    • Re: ssh_init: Network error: Connection refused
      ... I wasn't sure how to determine listening on port 22 from ... > - Use lsof to determine if either of those processes is listening on port ... > otherwise you'd get a timeout instead of "connection refused"). ...
      (comp.security.ssh)
    • Re: lsof on solaris 10
      ... i have a problem with lsof under solaris 10 sparc: ... Have you tried telnetting to that machine on port 65535 if it is Apache ... reproduce it on my own fully patched Solaris 10/x86 Update 2 system: ... are listening on port 65535. ...
      (comp.unix.solaris)
    • Re: lsof on solaris 10
      ... i have a problem with lsof under solaris 10 sparc: ... reproduce it on my own fully patched Solaris 10/x86 Update 2 system: ... are listening on port 65535. ... Is always a good idea to look for lsof patches. ...
      (comp.unix.solaris)
    • lsof does not show open ports after latest OS Recommended patches
      ... recommended patches and then I had a surprise: lsof doesn't show the ... is listening on tcp *.*!!!! ... All other program with open network sockets also show *.*. ...
      (comp.unix.solaris)