Date: Sat, 18 Sep 2010 21:37:54 -0700 From: Carl Johnson <carlj@peak.org> To: freebsd-questions@freebsd.org Subject: Re: extra open ports in rkhunter Message-ID: <87hbhmqrfh.fsf@oak.localnet> In-Reply-To: <86tylmzb3j.fsf@gmail.com> (Anonymous's message of "Sun, 19 Sep 2010 07:05:52 %2B0400") References: <87pqwar5sc.fsf@oak.localnet> <E0616266-D8C4-43CB-874D-1442CC4AE0F3@mac.com> <86tylmzb3j.fsf@gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Anonymous <swell.k@gmail.com> writes: > Chuck Swiger <cswiger@mac.com> writes: > >> Hi-- >> >> On Sep 18, 2010, at 4:27 PM, Carl Johnson wrote: >>> The following are the ports if anybody has any ideas, but I would also like to know how to trace them down myself: >>> >>> tcp4 0 0 *.876 *.* LISTEN >>> tcp6 0 0 *.921 *.* LISTEN >>> udp4 0 0 *.608 *.* >>> udp6 0 0 *.952 *.* >>> udp6 0 0 *.804 *.* > > Do you have some networking FS enabled (NFS, AFS, Coda, etc)? Perhaps, > one of them listens for connections from kernel and is not associated > with userland process. But it's just a guess. I have NFS enabled, but its processes are accounted for by both sockstat and netstat. > Speaking of processes, procstat(1) can show them, too. Procstat seems to show the same ports as sockstat and doesn't show any of the extra ports that netstat does. Thanks for the reply. -- Carl Johnson carlj@peak.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?87hbhmqrfh.fsf>