RE: Open ports on Suse linux

The rpcinfo -p returned the following:


oraprd:~ # rpcinfo -p
   program vers proto   port
    100000    2   tcp    111  portmapper
    100000    2   udp    111  portmapper
    100024    1   udp  32771  status
    100021    1   udp  32771  nlockmgr
    100021    3   udp  32771  nlockmgr
    100021    4   udp  32771  nlockmgr
    100024    1   tcp  32774  status
    100021    1   tcp  32774  nlockmgr
    100021    3   tcp  32774  nlockmgr
    100021    4   tcp  32774  nlockmgr
    100003    2   udp   2049  nfs
    100003    3   udp   2049  nfs
    100227    3   udp   2049  nfs_acl
    100003    2   tcp   2049  nfs
    100003    3   tcp   2049  nfs
    100227    3   tcp   2049  nfs_acl
    100005    1   udp    997  mountd
    100005    1   tcp    998  mountd
    100005    2   udp    997  mountd
    100005    2   tcp    998  mountd
    100005    3   udp    997  mountd
    100005    3   tcp    998  mountd

The port 32774 is included in this.  I am not very knowledgeable in this
area.  Is this normal or is it an area of security concern?  How does rpc
get invoked and where does it decide what ports it will use?

Thanks again for all the help.  All y'all have been very helpful.

Thanks
Craig E. Ward
803-517-0217 

-----Original Message-----
From: Konstantin 'Kastus' Shchuka [mailto:[email protected]] 
Sent: Friday, October 05, 2007 4:46 PM
To: [email protected]
Subject: Re: [suse-oracle] Open ports on Suse linux

It looks like RPC stuff. What does 'rpcinfo -p' return?

On Fri, Oct 05, 2007 at 02:46:19PM -0400, Craig Ward wrote:
> Alexei,
> 
> I ran the commands you suggested and was able to find the one processes
> owner.  The  other one though came up with the folling:
> 
> oraprd:~ # fuser 32774/tcp
> here: 32774
> 
> As there is no process id number, I don't know how to track this any
> further.  I would appreciate any other suggestions.
> 
> Thanks
> Craig E. Ward
> 803-817-6438
> 
> -----Original Message-----
> From: Alexei_Roudnev [mailto:[email protected]] 
> Sent: Friday, October 05, 2007 12:03 AM
> To: Craig Ward; [email protected]
> Subject: Re: [suse-oracle] Open ports on Suse linux
> 
> fuser <port_number>/tcp is your friend.
> 
> It will show  process, which keeps port open (but better run, first
> 
>  netstat -an | grep tcp | grep LISTEN
> 
> to see if port is really open.)
> 
> ----- Original Message ----- 
> From: "Craig Ward" <[email protected]>
> To: <[email protected]>
> Sent: Thursday, October 04, 2007 11:04 AM
> Subject: [suse-oracle] Open ports on Suse linux
> 
> 
> > SuSE guru's -
> >
> > I have a question I hope will be easily answered.  On our production 
> > server,
> > SLES-9, we have two ports that are open and we can't find out what is
> > opening them, or why.  I also have been unable to find how to close the
> > ports.
> >
> > I ran nmap on them and got the following:
> >
> > oraprd:~ # nmap -p 12345 oraprd
> >
> > Starting nmap 3.50 ( http://www.insecure.org/nmap/ ) at 2007-10-04 14:05

> > EDT
> > Interesting ports on oraprd.raclocal.com (10.119.8.48):
> > PORT      STATE SERVICE
> > 12345/tcp open  NetBus
> >
> > Nmap run completed -- 1 IP address (1 host up) scanned in 0.330 seconds
> > oraprd:~ # nmap -p 32774 oraprd
> >
> > Starting nmap 3.50 ( http://www.insecure.org/nmap/ ) at 2007-10-04 14:05

> > EDT
> > Interesting ports on oraprd.raclocal.com (10.119.8.48):
> > PORT      STATE SERVICE
> > 32774/tcp open  sometimes-rpc11
> >
> > Nmap run completed -- 1 IP address (1 host up) scanned in 0.330 seconds
> >
> > I would appreciate any help or insights as to what I can do to either
> > identify why they are open or how to close them.
> >
> > Thanks
> > Craig Ward

-- 
To unsubscribe, email: [email protected]
For additional commands, email: [email protected]
Please see http://www.suse.com/oracle/ before posting



-- 
To unsubscribe, email: [email protected]
For additional commands, email: [email protected]
Please see http://www.suse.com/oracle/ before posting