The Planet Forums > Port 1040

Full Version: Port 1040

The Planet Forums > Security > General Security

CyberSEAL

Feb 18 2009, 06:54 PM

I have a new server that has this listening on port 1040, anyone know what it is?

CODE

[root@secure ~]# netstat -alnp | more
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name
tcp        0      0 0.0.0.0:2082                0.0.0.0:*                   LISTEN      5914/cpsrvd - waiti
tcp        0      0 0.0.0.0:2083                0.0.0.0:*                   LISTEN      5914/cpsrvd - waiti
tcp        0      0 0.0.0.0:2086                0.0.0.0:*                   LISTEN      5914/cpsrvd - waiti
tcp        0      0 0.0.0.0:2087                0.0.0.0:*                   LISTEN      5914/cpsrvd - waiti
tcp        0      0 0.0.0.0:3306                0.0.0.0:*                   LISTEN      6351/mysqld
tcp        0      0 0.0.0.0:2095                0.0.0.0:*                   LISTEN      5914/cpsrvd - waiti
tcp        0      0 127.0.0.1:783               0.0.0.0:*                   LISTEN      5733/spamd.pid --ma
tcp        0      0 0.0.0.0:2096                0.0.0.0:*                   LISTEN      5914/cpsrvd - waiti
tcp        0      0 0.0.0.0:1040                0.0.0.0:*                   LISTEN      6969/perl

CODE

[root@secure ~]# lsof -p 6969
COMMAND    PID USER   FD   TYPE DEVICE     SIZE    NODE NAME
ipalert_s 6969 root  cwd    DIR    8,5     4096       2 /
ipalert_s 6969 root  rtd    DIR    8,5     4096       2 /
ipalert_s 6969 root  txt    REG    8,3  1004478  983203 /usr/bin/perl
ipalert_s 6969 root  mem    REG    8,3   104388 1443201 /usr/lib/perl5/5.8.8/i686-linux/auto/POSIX/POSIX.so
ipalert_s 6969 root  mem    REG    8,5   125736  950290 /lib/ld-2.5.so
ipalert_s 6969 root  mem    REG    8,5  1606808  950297 /lib/libc-2.5.so
ipalert_s 6969 root  mem    REG    8,5    16428  950321 /lib/libdl-2.5.so
ipalert_s 6969 root  mem    REG    8,5   208352  950305 /lib/libm-2.5.so
ipalert_s 6969 root  mem    REG    8,5    46680  950312 /lib/libnss_files-2.5.so
ipalert_s 6969 root  mem    REG    8,5   101404  950313 /lib/libnsl-2.5.so
ipalert_s 6969 root  mem    REG    8,5    45288  950325 /lib/libcrypt-2.5.so
ipalert_s 6969 root  mem    REG    8,3    22792 1443271 /usr/lib/perl5/5.8.8/i686-linux/auto/Socket/Socket.so
ipalert_s 6969 root  mem    REG    8,5    15164  950347 /lib/libutil-2.5.so
ipalert_s 6969 root  mem    REG    8,3 56430416 1182637 /usr/lib/locale/locale-archive
ipalert_s 6969 root    0u   CHR    5,1              722 /dev/console
ipalert_s 6969 root    1u   CHR    5,1              722 /dev/console
ipalert_s 6969 root    2u   CHR    5,1              722 /dev/console
ipalert_s 6969 root    3u  IPv4  14051              TCP *:netarx (LISTEN)

James Jhurani

Feb 18 2009, 08:40 PM

Do you have IPAlerts setup for that server? It looks like the agent.

CyberSEAL

Feb 18 2009, 09:38 PM

I don't have it setup, and TP says this wasn't included in their Linux/cPanel image. The only software I've installed so far is APF firewall and Adaptec Storage Manager for the RAID card.

CyberSEAL

Feb 18 2009, 09:54 PM

Uhh, I'm an id...you're right:

/usr/local/bin/ipalert_statd

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.