[Wylug-help] Strange UDP port activity

fluffy at fluffybacon.co.uk fluffy at fluffybacon.co.uk
Wed Feb 2 07:20:00 GMT 2005


Hi,

Can anyone tell me what's happening here?

nmap -sU -sV -p- 127.0.0.1

Interesting ports on localhost.localdomain (127.0.0.1):
(The 65532 ports scanned but not shown below are in state: closed)
PORT      STATE         SERVICE    VERSION
68/udp    open|filtered dhcpclient
111/udp   open          rpcbind    2 (rpc #100000)
50682/udp open          unknown

------------------------

Interesting ports on localhost.localdomain (127.0.0.1):
(The 65532 ports scanned but not shown below are in state: closed)
PORT      STATE         SERVICE    VERSION
68/udp    open|filtered dhcpclient
111/udp   open          rpcbind    2 (rpc #100000)
62421/udp open          unknown

-----------------------

The port number changes EVERY TIME I run nmap, netstat shows nothing and
both rkhunter and chkrootkit say nothing suspicious is going on.

As the port number keeps changing, I can't use fuser to find out what's
running on these random ports and before I reformat the machine I was
just wondering if anyone else could help?

Thanks,
Ciaran.







More information about the Wylug-help mailing list