Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was doing a quick port scan at work (Nmap 6, OS X 10.6.8), and I noticed that nearly all of the computers around me were running a service called "netvenuechat" on Port 1023. Although I've searched through several forum posts and have found many others running the same service, I have not found a distinct answer as to the validity of this service.

Is this a normal background service, or is this service part of some malware?

share|improve this question
up vote 1 down vote accepted

Officially, according to IANA (the Internet Assigned Numbers Authority), port 1023 is "reserved", whether being used for TCP or UDP.

Many sites claim to list the known software packages (legit and malware) and well-known protocols that use various ports, and it's hard to know who to trust. However, this listing at seems pretty legit, and lists the following known users:

  • A couple variants of the "Sasser" malware
  • NetMeeting with H323
  • Nortel NetVenue Notification, Chat, Intercom
  • Linux backend of Gateway GS-400 NAS

If you aren't aware of people in your company running Nortel NetVenue or Microsoft NetMeeting (which used to be built into Windows, I think), and if it's likely people may still be running Windows XP or Windows 2000, then they could well be infected with the "Sasser" malware. Then again, it could be some other piece of software that happened to use that port.

share|improve this answer
Thanks! This certainly cleared up any questions I had :) – gerberduffy Jul 12 '12 at 17:30

Nmap does not have a service discovery match for netvenuechat, so that label is being applied as a simple lookup of 1023/tcp in the nmap-services file. If you want to find out what is actually running on that port, you can either perform a Service/Version Detection scan with the -sV option, or try to determine what process is listening by running commands on the target machine (all of these will require administrator/root privilege):

Windows commands: netstat -anb, SysInternals TCPView

Linux commands: netstat -tanp, lsof -n -i

share|improve this answer
Thanks, I will try that! – gerberduffy Jul 12 '12 at 17:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .