I use netstat -ln command to check my server recently and got the result as following:

Could anyone tell me what is port 713, 714, 715, 631 and 1040 for ?
especially to the port 713~715, I did not notice these port before

Thanks

******************************************
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:110 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:9999 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:1040 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:631 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN
udp 0 0 127.0.0.1:53 0.0.0.0:*
udp 0 0 67.18.**.***:53 0.0.0.0:*
udp 0 0 0.0.0.0:713 0.0.0.0:*
udp 0 0 0.0.0.0:714 0.0.0.0:*
udp 0 0 0.0.0.0:715 0.0.0.0:*
udp 0 0 0.0.0.0:631 0.0.0.0:*
Active UNIX domain sockets (only servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 3213 /dev/gpmctl
unix 2 [ ACC ] STREAM LISTENING 86593696 /tmp/ssh-YZG14444/agent.14444
unix 2 [ ACC ] STREAM LISTENING 3223 /var/lib/mysql/mysql.sock
*******************************************************

austboz

Try:



And that will show you the process also.

You can also try:



Which is another way to display it (that only does port 713).

Frank

tcp 0 0 0.0.0.0:1040 0.0.0.0:* LISTEN 3230/perl
udp 0 0 0.0.0.0:713 0.0.0.0:* 3081/xinetd
udp 0 0 0.0.0.0:714 0.0.0.0:* 3081/xinetd
udp 0 0 0.0.0.0:715 0.0.0.0:* 3081/xinetd
udp 0 0 0.0.0.0:631 0.0.0.0:* 29497/cupsd

Thanks a lot, could u take a look at this and give me some advice?

austboz,



port 1040 is a monitoring daemon that ServerMatrix/ThePlanet puts on all linux boxes. It's used if you request that they monitor a process, load, disk space etc. From the output above it's running on process id 3230, so you can run:



and you'll see more about that process.

631 is cups, which is a linux printing daemon. I'm sure you're not printing anything ;-) so you should be able to :



That will stop cups and then remove it from the startup stuff.

UDP ports 713-715 are still a mistery to me. try the lsof -i udp:713 and it may give you a bit more detail.

Frank

Whatever is on those ports are being ran by the XINETD superdaemon. I've always just used INETD, if I used either. I'm not sure how XINETD works but INETD would have a configuration file in /etc, called inetd.conf .. Inside that file would be a list of services that INETD would run.

You should check /etc for xinetd.conf or an xinetd directory, and see what its starting.

bellow is the new output:

************************************************
[root@zeus root]# ps -ef | egrep 3081
root 3081 1 0 Jun01 ? 00:00:00 xinetd -stayalive -pidfile /var/run/xinetd.pid
root 14328 10794 0 07:52 pts/0 00:00:00 grep -E 3081


[root@zeus root]# lsof -i udp:713
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
xinetd 3081 root 6u IPv4 3180 UDP *:713
*************************************************

Is there a way to find out which program use port 713~715 ?

I just gave you a suggestion concerning that You need to find the configuration file from XINETD.. It should be in /etc/

It will list all the services XINETD is configured to start, including inactive ones which will be commented out if it looks anything like INETD's.

XINETD is what opened the port, but he's sending the data to some other service. INETD and XINETD are super daemons.. They run other programs and services underneathe them, so all you see is XINETD instead of all the little services its running.

List and descriptions of all ports:

http://www.iana.org/assignments/port-numbers

regards.

this right here scares me

unix 2 [ ACC ] STREAM LISTENING 86593696 /tmp/ssh-YZG14444/agent.14444

I'd look into what that is ASAP.

Hi, Matt

isn't /tmp/ssh-YZG14444/ageng.1444 used by ssh-agent as socket-file ?

Is there any problem?

Can anyone from The Planet confirm this?

I'm running RHEL5 and this port is/was open on my machine. Was looking up some information on the port, and found that went to a service that I don't even have installed, so I blocked access to the port.

This port was accepting Telnet access, and echo'd back with Unknown command on almost everything. If this is indeed a valid port, what are valid commands?

I'm very sure this is no longer valid.

can you paste the "netstat -lnpt".

port 1040 is ip alert:
[root@server ~]# ps aux | grep 4037
root 557 0.0 0.0 3732 636 pts/1 S+ 11:37 0:00 grep 4037
root 4037 0.0 0.0 6316 2044 ? Ss 2007 0:00 /usr/bin/perl /usr/local/bin/ipalert_statd
[root@server ~]#

Hmm .. Did you ever check the files listed in /etc/xinetd.d for clues on what was running on
UDP ports 713, 714 and 715?



I'm not familiar with these ports