1

Running openSUSE 11.2 x86_64.

Here's what a nmap of my IP provides:

PORT STATE SERVICE
23/tcp open telnet
80/tcp open http
2800/tcp open unknown
8008/tcp open http

I would like to know how to view what service is causing port 2800 to be opened?

A few search engine results led me to believe that it is supposedly a port opened by a Trojan called "Theef".

If it is indeed a Trojan, what can be done to weed it out? Is my desktop's security compromised?

Improve this question

3 Answers 3

Reset to default
1

what do you see after running (as root):

nmap -sV --version-intensity 9 -p 2800 localhost

What makes you think you have a trojan? What have you been doing lately? And why are you running telnet?

Improve this answer
2
  • That worked. The Port's State returns as Closed. As to your questions: What makes you think you have a trojan? Curiosity. What have you been doing lately? Nothing noteworthy, except some basic coding. Why are you running telnet? Self-Vulnerability Test? :-).
    – meh
    Jun 5, 2010 at 15:56
  • -sV is for identifying V-ersion numbers of any services or daemons running on the host(s). It shouldn't actually close any already open ports. Maybe something else happened....
    – Felipe Alvarez
    Jun 6, 2010 at 3:24
1

The -p switch to netstat should show you what processes have what ports open:

sudo netstat -p
Improve this answer
1

lsof can help also:

sudo lsof -i TCP:2800
Improve this answer
2
  • Tried that command, Port 80 returns results. Ports 23,2800,8008 refuse to do so. No results appear. Also tried fuser -nu tcp 2800, fuser 2800/tcp they also do not return anything.
    – meh
    Jun 1, 2010 at 20:39
  • I didn't know one could do that with lsof and fuser.
    – Felipe Alvarez
    Jun 6, 2010 at 3:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .