Re: What are ports 738, 877?

From: Andrew Keith (andrew_at_jukenworld.com)
Date: 06/02/04 

Date: Wed, 2 Jun 2004 12:44:03 +0800

according to my services file, rpc.statd runs by default on port 950/tcp.
hmmm..

try killing both those programs. Seems fishy ..

Andrew

"Mike Oliver" <mike_lists@verizon.net> wrote in message
news:2i4vcgFj401pU1@uni-berlin.de...
> Andrew Keith wrote:
>
> > run netstat -tlp
> > you will be able to see the program which opened that port.
> > According to my services file, there is no well known service for port
738
> > and 877.
>
> famd and rpc.statd, respectively. I suppose these are really no more
> suspicious than the ports with names.
>
> So, looking at the output of "netstat -tlp", can you tell
> me if I have any service running that could be exploited even
> by a holder of the root password? Not that I have any reason
> to believe there is any such person other than me; just
> a "locked doors inside locked doors" thing.
>
> Output follows (each line breaks at "*:*"):
>
> Active Internet connections (only servers)
> Proto Recv-Q Send-Q Local Address Foreign Address
> State PID/Program name
> tcp 0 0 localhost:738 *:*
> LISTEN 1410/famd
> tcp 0 0 *:printer *:*
> LISTEN 1429/lpd
> tcp 0 0 *:time *:*
> LISTEN 1424/inetd
> tcp 0 0 *:discard *:*
> LISTEN 1424/inetd
> tcp 0 0 *:877 *:*
> LISTEN 1543/rpc.statd
> tcp 0 0 *:daytime *:*
> LISTEN 1424/inetd
> tcp 0 0 *:sunrpc *:*
> LISTEN 1244/portmap
> tcp 0 0 *:auth *:*
> LISTEN 1424/inetd
> tcp 0 0 localhost:smtp *:*
> LISTEN 1405/exim4