ports 382, 681, 947, 1018 show active on a security scan

[Tim Killinger]

Our coprporate security group is running security port scans on an HPUX 11.11 server in our shop. Ports 382, 681, 947 and 1018 are showing open, but we cannot identify the process(es) listening on these ports. If we do and 'lsof -i:382' nothing is returned....

Do these specific ports ring a bell to anyone? Thanks in advance.

[Kenan Erdey]

Hi,

you can check these ports in /etc/services file.

[Fredrik.eriksson]

or just run netstat and see what it says. If they're defined in services file it'll sub in netstat :)

But I do agree, looks like wierd ports.
http://www.pc-library.com/ports/tcp-udp-port/382/
http://www.pc-library.com/ports/tcp-udp-port/681/

Can't seem to find any info on the other 2 thou.

Best regards
Fredrik Eriksson

[Jeroen Peereboom]

See http://docs.hp.com/en/5990-7252/ch01s01.html for port 382. It is used for OpenView Performance Agent.

3 more to go...

JP

[Laurent Menase · Accepted solution]

Ports 382, 681, 947 and 1018
If they don't appear in lsof output
it can be because there is a module pushed betwen socket & tcp layer which makes lsof can't get the values
or because it is opened by the kernel directly.

like kernel rpc,
only some support tools can give the informations about those ports for some of them.

There is crashinfo -ofiles -v
and nfsshow -krpc
for instance