Tcp Port Open by Unknown Service

Question

Running openSUSE 11.2 x86_64.

Here's what a nmap of my IP provides:

PORT STATE SERVICE
23/tcp open telnet
80/tcp open http
2800/tcp open unknown
8008/tcp open http

I would like to know how to view what service is causing port 2800 to be opened?

A few search engine results led me to believe that it is supposedly a port opened by a Trojan called "Theef".

If it is indeed a Trojan, what can be done to weed it out? Is my desktop's security compromised?

Felipe Alvarez · Answer 1 · 2010-06-03 13:48:43Z

up vote 0 down vote accepted

what do you see after running (as root):

nmap -sV --version-intensity 9 -p 2800 localhost

What makes you think you have a trojan? What have you been doing lately? And why are you running telnet?

answered Jun 3 '10 at 13:48

	That worked. The Port's State returns as Closed. As to your questions: What makes you think you have a trojan? Curiosity. What have you been doing lately? Nothing noteworthy, except some basic coding. Why are you running telnet? Self-Vulnerability Test? :-). – Singularity Jun 5 '10 at 15:56
	-sV is for identifying V-ersion numbers of any services or daemons running on the host(s). It shouldn't actually close any already open ports. Maybe something else happened.... – Felipe Alvarez Jun 6 '10 at 3:24

feedback

Sean Edwards · Answer 2 · 2010-06-01 16:10:35Z

up vote 1 down vote

The -p switch to netstat should show you what processes have what ports open:

sudo netstat -p

answered Jun 1 '10 at 16:10

feedback

Doug Harris · Answer 3 · 2010-06-01 18:31:39Z

up vote 1 down vote

lsof can help also:

sudo lsof -i TCP:2800

answered Jun 1 '10 at 18:31

	Tried that command, Port 80 returns results. Ports 23,2800,8008 refuse to do so. No results appear. Also tried `fuser -nu tcp 2800`, `fuser 2800/tcp` they also do not return anything. – Singularity Jun 1 '10 at 20:39
	I didn't know one could do that with `lsof` and `fuser`. – Felipe Alvarez Jun 6 '10 at 3:25

feedback

3 Answers