SYSLOG Message: ident/tcp: bind: Address already in use

[Robert Hoey]

Good morning,

I've recently noticed that in my syslog, I received the following message every ten minutes:
Nov 28 08:58:59 vad390 inetd[724]: ident/tcp: bind: Address already in use
Nov 28 08:58:59 vad390 inetd[724]: ident/tcp: Service enabled

Can anyone explain what this is?

From my research, I am guessing that inetd may be configured improperly.

I've read that the quick fix is to reboot the system. I did that, and I am still receiving the messages.

I then checked /etc/inetd.conf and changed
"ident stream tcp nowait bin /opt/socks/sbin/in.identd in.identd"
to
"ident stream tcp wait bin /usr/lbin/identd identd -w"
and then used "inetd -c" to reread the inetd.conf file.

I am still getting the messages.

Any help would be greatly appreciated.

-Rob

HP-UX 10.20
HP9000 - D390

[Craig Rants]

Robert,
Do a netstat -an and look for activity on port 113. You may then want to look at using lsof to see what app is using tcp/113. It appears something besides ident may have grabbed that port and is listening on there.

Good Luck,
C

[S.K. Chan · Accepted solution]

Check if yr /etc/inetd.conf is mis-configured which contains this line:

auth stream tcp wait bin /usr/lbin/identd identd -w -t120"

It should be ..

ident stream tcp wait bin /usr/lbin/identd identd

while the entry in /etc/services should read:

ident 113/tcp

[Uday_S_Ankolekar]

Hi,
check with netstat -an and and look for those port numbers (or just netstat -a if you want to see the names instead of the numbers) and possibly consider running a copy of lsof (from the net) to see which process(es) have those port numbers allocated.
Or You probably have multiple inetd services running. kill them all and restart one

Goodluck,
-USA..

Or

[Johan Carlsson]

Hi Robert,

Did you have a look in case A4480363? You should be able to find it under technical knowledge base.

Otherwise I pasted the text below:

A4480363
ARPA: Misconfigured etc/inetd.conf file

Problem Description

Why is the the following error message
written to syslog?

ident /tcp bind address already in use

Configuration Info

Operating System - HP-UX
Version - 10.20
Hardware System - HP 9000
Series - S712

Solution

This is a known error that occurs on systems
whose /etc/inetd.conf contains the following
line:

auth stream tcp wait bin /usr/lbin/identd identd -w -t120"

As per the inetd page, which supports RFC 1413,
the following is the correct setting for the
/etc/inetd.conf file:

ident stream tcp wait bin /usr/lbin/identd identd

while the entry in /etc/services should read:

ident 113/tcp # RFC1413 server

Verify this and I??ll check back on the forum soon again. :)

/Johan Carlsson

[Sanjay_6]

Hi Robert,

You can try inetd to reread its configuration, "inetd -c". If that does not help, reboot the system.

Hope this helps.

Regds

[Robert Hoey]

Thank you all.

Sanjay, Johan, and S.K. - I already tried all of your suggestions with no change in syslog.

Craig and Uday - I tried netstat -an. Here's what I got.

# netstat -an | grep 113
tcp 0 0 *.113 *.* LISTEN
# ps -ef | grep inetd
root 724 1 0 08:18:58 ? 0:00 /usr/sbin/inetd

So, it seems that tcp is the only one using 113 and there is only one inetd process running.

What is lsof? Does it show more info than netstat?

Thanks.
-Rob

[Craig Rants]

lsof will tell you what process has claimed that port. Very helpful to corelate the ps and netstat output.

[Sanjay_6]

Hi Robert,

Here is the faq on "lsof"

ftp://vic.cc.purdue.edu/pub/tools/unix/lsof/FAQ

Hope this helps.

Regds

[Uday_S_Ankolekar]

Hi

You can down load lsof from the hp's proting site ; here is the address
http://hpux.cs.utah.edu/hppd/

It is a good tool to have..
-USA..