0

When I did a port scan nmap -p- localhost of my local system I found some unknown ports opened. I was using a closed source application when this happened and I known its this causing port opening. Everytime I open this software it uses a different port.

To find the process associated with the port I used sudo lsof -i TCP:48292

COMMAND     PID USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
somefunc  12819  eka    3u  IPv4 2132143      0t0  TCP localhost:48292 (LISTEN)

This closed source software is always using somefunc command to open random ports on everyrun.

How can I block this command from opening any more ports?

Edit: Its confirmed this closed source software is running somefunc. I found the source directory using pwdx 12819

  • 1
    If I had no choice but to run it I would do so in a VM and firewall it to hell. – davidgo Jan 9 at 9:52
  • Depending on what this closed source application does, it may be perfectly legitimate behaviour, and blocking it may cause it to stop working. If you are worried, sandbox it (in a network namespace, or VM), and monitor the traffic to the sandbox to see if anything interesting happens. – dirkt Jan 9 at 11:58
  • @dirkt It may or may not be malicious. There are two reasons why I dont want this open port first it doesn't need any kind of connections for its normal function and second I have installed this closed soure app using root level. I will try to sandbox this can you recommend any good one? – Eka Jan 9 at 14:39
  • @Eka: How do you know for sure that it doesn't need any connections? The socket is not open to the network -- it is bound to localhost, which is very common for inter-process communications (i.e. between two components of the program, or between daemon and UI). (For the same reason, there's not much point in sandboxing it.) – grawity Jan 9 at 15:26

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.