Re: [cobalt-users] UDP Port 1420 on RaQ4 - What is it?

[flash22@xxxxxxx]

On Sat, 17 Feb 2001, Rick Ewart wrote:

> Hey all.
> 
> Netstat on my RaQ4 reveals that Port 1420 is running UDP. Its not listening
> or anything so I think its harmless enough, but I don't recall it being
> there before... I looked it up in the list of services, and the only thing
> that is registered for that port is Timbuktu, but there doesn't appear to be
> a linux version of timbuktu. I sorta recall that PortSentry opens up a port
> when running in advanced stealth modes. Not too clear on that, though...
> 
> Anybody know what it is? I looked but it doesn't seem like its been
> discussed yet. Anybody else have it open?

Keep in mind that some services open additional ports for data
connections,(above 1024) the networker client does this, and bind does
this sometimes,

To figure out who owns it you can use fuser (as root or it will quietly
ignore you :)

ex: netstat -a
udp        0      0 *:1964                  *:*                                 

/usr/sbin/fuser -u 1964/udp
1964/udp:            30598(root)

lookup the pid to find program..

ps e 30598
30598  ?  S   17:52 named -u named HISTSIZE=1000 HOSTNAME=admin.xxxxx..

Ahh...it's the nameserver listening ....