3

I was doing a quick port scan at work (Nmap 6, OS X 10.6.8), and I noticed that nearly all of the computers around me were running a service called "netvenuechat" on Port 1023. Although I've searched through several forum posts and have found many others running the same service, I have not found a distinct answer as to the validity of this service.

Is this a normal background service, or is this service part of some malware?

1

Officially, according to IANA (the Internet Assigned Numbers Authority), port 1023 is "reserved", whether being used for TCP or UDP.

Many sites claim to list the known software packages (legit and malware) and well-known protocols that use various ports, and it's hard to know who to trust. However, this listing at SpeedGuide.net seems pretty legit, and lists the following known users:

  • A couple variants of the "Sasser" malware
  • NetMeeting with H323
  • Nortel NetVenue Notification, Chat, Intercom
  • Linux backend of Gateway GS-400 NAS

If you aren't aware of people in your company running Nortel NetVenue or Microsoft NetMeeting (which used to be built into Windows, I think), and if it's likely people may still be running Windows XP or Windows 2000, then they could well be infected with the "Sasser" malware. Then again, it could be some other piece of software that happened to use that port.

  • Thanks! This certainly cleared up any questions I had :) – a10y Jul 12 '12 at 17:30
1

Nmap does not have a service discovery match for netvenuechat, so that label is being applied as a simple lookup of 1023/tcp in the nmap-services file. If you want to find out what is actually running on that port, you can either perform a Service/Version Detection scan with the -sV option, or try to determine what process is listening by running commands on the target machine (all of these will require administrator/root privilege):

Windows commands: netstat -anb, SysInternals TCPView

Linux commands: netstat -tanp, lsof -n -i

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.