topic Re: Port No. 6000 in Operating System - HP-UX

Port No. 6000

Abhishek Chauhan — Mon, 03 Jul 2006 08:22:29 GMT

Hi,
We have two HP Servers. On one of the HP servers, we are seeing many connections, with port number 6000. The netstat -an command output shows

tcp 0 0 10.132.121.51.49964 10.132.121.36.6000 ESTABLISHED

We have rebooted the 10.132.121.36 machine, but all the sessions still remain in this state.
How can we kill all these sessions?

Re: Port No. 6000

Denver Osborn — Mon, 03 Jul 2006 08:31:51 GMT

Port 6000 is for X. You won't want to kill any of those processes. Instead have you looked into X11Forward if using ssh?

-denver

Re: Port No. 6000

Steven E. Protter — Mon, 03 Jul 2006 08:33:39 GMT

Shalom,

Take a look at /etc/services

See if there is an entry for port 6000.

There is probably an application using the port. It seems to be a peristant application since it reconnects after boot.

Take a look at the source ip address: 10.132.121.51

Find out what application its running and perhaps talk to the user or sysadmin before trying to kill the application and disrupting things.

Or use a firewall to block port 6000, your choice.

SEP

Re: Port No. 6000

Abhishek Chauhan — Mon, 03 Jul 2006 08:40:18 GMT

Hi Denver,
The 10.132.121.36 is not under production.Only 10.132.121.51 is being used.
So, we want to remove all these 10.132.121.36 sessions.
How can we check if X11 is using ssh?

Reg,
Abhishek

Re: Port No. 6000

Denver Osborn — Mon, 03 Jul 2006 08:49:45 GMT

With your sshd_config you can check that "X11Forwarding yes" is there. However, if you have users connecting to dtlogin via xdmcp from something like reflection-x or xterms, setting up ssh to use X11Forwarding won't help. You'd still see established connections. I think you'd want to turn off xdmcp...

info to help you out there is on this thread...
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=945618

A lot of info available on the forums. You can search for things like port 6000, xdmcp and x11forwarding.

-denver

Re: Port No. 6000

Ludovic Derlyn — Mon, 03 Jul 2006 09:47:32 GMT

hi,

just an idea for identify ports :

http://www.iana.org/assignments/port-numbers

regards

L-DERLYN