[Courses] [Security]another netstat

[Lorne Gutz]

On Tue, Mar 05, 2002 at 06:00:48PM -0500, Raven, corporate courtesan wrote:
> If anyone feels like posting
> the netstat info from their system for comment, we can go over what you
> should and shouldn't see here.  For the most part, if you don't know
> what it is, you probably shouldn't have it listening on a port here.


This computer was SuSE 7.1, then upgraded to 7.3.  Nothing special has
ever been done to make it secure because it runs behind a firewall.
It operates on a network where the majority of computer run NT.

grumpy:/home/lgutz # netstat -pl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State     
  PID/Program name
tcp        0      0 *:login                 *:*                     LISTEN    
  1110/inetd
tcp        0      0 *:nfs                   *:*                     LISTEN    
  947/rpc.nfsd
tcp        0      0 *:time                  *:*                     LISTEN    
  1110/inetd
tcp        0      0 *:sco-sysmgr            *:*                     LISTEN    
  859/ypbind
tcp        0      0 *:finger                *:*                     LISTEN    
  1110/inetd
tcp        0      0 *:sunrpc                *:*                     LISTEN    
  531/portmap
tcp        0      0 *:6000                  *:*                     LISTEN    
  7242/X
tcp        0      0 *:www-http              *:*                     LISTEN    
  1234/httpd
tcp        0      0 *:723                   *:*                     LISTEN    
  543/rpc.statd
tcp        0      0 *:ssh                   *:*                     LISTEN    
  439/sshd
tcp        0      0 *:telnet                *:*                     LISTEN    
  1110/inetd
tcp        0      0 *:ipp                   *:*                     LISTEN    
  597/cupsd
tcp        0      0 *:smtp                  *:*                     LISTEN    
  823/sendmail: accep
tcp        0      0 *:700                   *:*                     LISTEN    
  944/rpc.mountd
tcp        0      0 *:auth                  *:*                     LISTEN    
  639/in.identd
udp        0      0 *:filenet-tms           *:*                               
  -
udp        0      0 *:nfs                   *:*                               
  947/rpc.nfsd
udp        0      0 *:talk                  *:*                               
  1110/inetd
udp        0      0 *:ntalk                 *:*                               
  1110/inetd
udp        0      0 *:797                   *:*                               
  -
udp        0      0 *:798                   *:*                               
  -
udp        0      0 *:799                   *:*                               
  -
udp        0      0 *:mdbs_daemon           *:*                               
  -
udp        0      0 *:time                  *:*                               
  1110/inetd
udp        0      0 *:697                   *:*                               
  944/rpc.mountd
udp        0      0 *:959                   *:*                               
  859/ypbind
udp        0      0 *:720                   *:*                               
  543/rpc.statd
udp        0      0 *:725                   *:*                               
  543/rpc.statd
udp        0      0 *:32868                 *:*                               
  28720/kmail
udp        0      0 *:hmmp-op               *:*                               
  859/ypbind
udp        0      0 *:sunrpc                *:*                               
  531/portmap
udp        0      0 *:ipp                   *:*                               
  597/cupsd
udp        0      0 grumpy.vistar.ca:ntp    *:*                               
  1046/ntpd
udp        0      0 localhost:ntp           *:*                               
  1046/ntpd
udp        0      0 *:ntp                   *:*                               
  1046/ntpd
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node PID/Program name    
Path
unix  2      [ ACC ]     STREAM     LISTENING     2461781 28240/kdeinit: Runn 
/home/lgutz/.kde2/socket-grumpy/
kdeinit-:0
unix  2      [ ACC ]     STREAM     LISTENING     2461808 28227/kdeinit: klau 
/home/lgutz/.kde2/socket-grumpy/
klauncherzlUg8b.slave-socket
unix  2      [ ACC ]     STREAM     LISTENING     232992 9271/artsd          
/tmp/mcop-fct2/grumpy_vistar_ca-2
437-3c7baec2
unix  2      [ ACC ]     STREAM     LISTENING     2461785 28223/kdeinit: dcop 
/tmp/.ICE-unix/28223
unix  2      [ ACC ]     STREAM     LISTENING     2461869 28239/artsd         
/tmp/mcop-lgutz/grumpy_vistar_ca
-6e4f-3c8623f2
unix  2      [ ACC ]     STREAM     LISTENING     2461908 28259/ksmserver     
/tmp/.ICE-unix/28259
unix  2      [ ACC ]     STREAM     LISTENING     2067   823/sendmail: accep 
/var/run/sendmail/control
unix  2      [ ACC ]     STREAM     LISTENING     141881 7242/X              
/tmp/.X11-unix/X0
grumpy:/home/lgutz #



have fun with this if you like
Lorne