Looking for RPC

[jerry1]

Does anyone know how I can look at what
is trying to send out RPC_GETPORT_Request from
a unix server to a PC.
I have a user that is getting bounded with
over a thousand a day to his PC.

[Jeff Schussele · Accepted solution]

Hi Jerry,

Use netstat -an (lsof is better) & watch for ports 1110 UDP/TCP or 2049 UDP/TCP as these are the NFS ports as I suspect they're trying to mount something from the PC.
And if it's that many I suspect that they've got an automount trying it over & over. So check /etc for any files starting with auto.

HTH,
Jeff

[Jeff Schussele]

If it does turn out to be NFS & you don't use it at all on that HP system, you can disable it by doing the following

Run
/sbin/init.d/nfs.server stop
/sbin/init.d/nfs.client stop
/sbin/init.d/nfs.core stop

Then edit /etc/rc.config.d/nfsconf & set all the following
NFS_CLIENT
NFS_SERVER
AUTOMOUNT
START_MOUNTD
AUTOFS
to 0 (zero) - then they won't start up at next boot.

HTH,
Jeff

[Steven E. Protter]

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/lsof-4.70/

gunzip the download file

swinstall -s /location_of_depot \*

There will be one error, suid the binary.

Then you can use lsof.

SEP

[jerry1]

I have lsof but what does that get me?
I don't see anything in netstat -an and
that would not show me what on the unix
server would be broadcasting RPC_GETPORT_Request.

There is nothing in the /var/adm/syslogs
either. And I have syslogd ficilities split into separate files at debug level.

I checked also rpc.lockd.log rpc.statd.log
rpcinfo. Nothing.

I am going to check and see if his PC is
trying to mount something or other.
But we use Advance server for mounting homes from unix to PC and that uses netbios.

[jerry1]

Jeff, I see what your talking about with lsof. I was using it wrong.

Thanks all.

[Kevin Wright]

I would run nettl to see what is leaving your NIC and where it is going.

[jerry1]

Kevin, do you have some good test examples
of options to run with nettl. man page looks
kind of cryptic and I will have to do some
tests with it since I have not used it before.