justify/shutoff port 888

[Lonny Balderston]

I have been asked to justify or shutoff port 888. Running HP-UX 11.11 on RP5450. I can see the port process: # netstat -an | grep -i listen | grep 888
tcp 0 0 *.888 *.* LISTEN
lsof does not see it, but crashinfo.exe does:
fd=4 file=0x47c951a8 vnode=0x6a4eb988: VNFS_SPEC/VCHR v_data=0x6a4eb980 v_rde
v=0x158c0001 sth=0x6a8f3c40 tcp_t=0x6a777c28 L=*:888 (LISTEN) ip ipc_t=0x6a6a5a2
8
Looks like it has something to do with NFS, but we have NFS shut off. Any ideas on how to justify or shutoff port 888? Thank you.

[Sandman!]

lsof does not see it yet netstat does? Puzzling indeed...can you post the output of the following command:

# lsof -i TCP:888

~thanks

[Lonny Balderston]

lsof -i TCP:888 = no output.

[Bill Hassell]

From common port numbers list:

accessbuilder 888/tcp AccessBuilder
accessbuilder 888/udp AccessBuilder

AccessBuilder is a set of boxes from 3COM that provides dial-up users with network access. Check if someone has added 888 to the /etc/services file. If so, there is likely some software (probably forgotten) that is connected with port 888. Removing it from /etc/services won't stop the software from running but may cause it to complain. /etc/services is mostly a name file but many processes get unhappy if their port doesn't have a name. Look for something non-standard in the kernel driver section of the system file.

[Lonny Balderston]

Accessbuilder not loaded. No reference to port 888/accessbuilder found in /etc/services or /etc/inetd.conf. Re "Look for something non-standard in the kernel driver section of the system file", can you be more specific about this? Thank you.

[Lonny Balderston]

I had to get this issue resolved like now, so opened case with HP Support. Here's the solution:
Identifying and closing port 888:

HP had me do " crashinfo -v -ofiles ". Much more output than the command I was using, " crashinfo -v ". vi-searching crashinfo output for ":888 ", here is the info for port 888:

pid p_maxof ofiles p_comm
----- ------- ------ ------
1560 4096 6 windu_registry
cwd vnode=0x6a826040: VVXFS/VDIR v_data=0x6b1ec580
fd=0 file=0x47c955c8 vnode=0x68d4a188: VNFS_SPEC/VCHR v_data=0x68d4a180 v_rde
v=0x03000002 /dev/null
fd=1 file=0x47c93520 vnode=0x68d4a188: VNFS_SPEC/VCHR v_data=0x68d4a180 v_rde
v=0x03000002 /dev/null
fd=2 file=0x47c92b80 vnode=0x69523700: VVXFS/VREG v_data=0x6963e040
fd=3 file=0x47c95410 socket=0x69725080: AF_UNIX/STREAM q0len=0 q0=0x0 qlen=0
q=0x0 (LISTEN) Inode=0x696424c0 Addr=/var/tmp/windu_sock_1560
fd=4 file=0x47c951a8 vnode=0x6a4eb988: VNFS_SPEC/VCHR v_data=0x6a4eb980 v_rde
v=0x158c0001 sth=0x6a8f3c40 tcp_t=0x6a777c28 L=*:888 (LISTEN) ip ipc_t=0x6a6a5a2
8 /dev/tcp

So program responsible is " windu_registry ", pid is " 1560 ".

# ps -ef | grep " 1560 " | grep -v grep
root 1560 1 0 Jan 28 ? 2:02 ./windu_registryd50 -d /var//opt/omni/windu/ -vers 2 -prog 8055

Omniback! Figures!

Check to see if port 888 still open:

# netstat -a | grep "\.888 " | grep -v grep
tcp 0 0 *.888 *.* LISTEN

Check DP for activity (GUI > monitor ), none, so cycle DP:

# /opt/omni/sbin/omnisv -stop
[ hang..... ]
HP OpenView Storage Data Protector services successfully stopped.

# netstat -a | grep "\.888 " | grep -v grep
[ no output ]

# /opt/omni/sbin/omnisv -start
HP OpenView Storage Data Protector services successfully started.

# netstat -a | grep "\.888 " | grep -v grep
[ no output ]

Got it! A hung DP session maybe?...

Now how can I assign myself 10 points?...

[Lonny Balderston]

See above entry.

[Sandman!]

Awesome for posting the resolution since most thread authors don't provide this kind of feedback. So the offending process was an Omniback hung while trying to do a backup of Windoze machine(s)?

[Lonny Balderston]

Unknown, but a I suspect you are right. My hunch is based on how long it took for DP to shut down. In hindsite, I should have checked for rogue (high-time) DP dbsm sessions; # ps -ef | grep dbsm . Thanks for your response!

[Duncan Edmonstone]

Lonny,

Actually windu_registryd50 is nothing to do with Omniback/Data Protector backups - its a daemon thats part of a toolkit used with Data Protector that allows GUI apps developed for Windows be easily ported to UNIX. If you're really interested you can read about it here:

http://www.actel.com/documents/wu500userguide.pdf

This daemon only gets started when someone starts the X Windows GUI for Omniback/Data Protector on a server. Solution to stop this happening is to not run xomni, but to install the DP GUI on your PC and access it from there.

HTH

Duncan