Port No. 6000

[Abhishek Chauhan]

Hi,
We have two HP Servers. On one of the HP servers, we are seeing many connections, with port number 6000. The netstat -an command output shows

tcp 0 0 10.132.121.51.49964 10.132.121.36.6000 ESTABLISHED

We have rebooted the 10.132.121.36 machine, but all the sessions still remain in this state.
How can we kill all these sessions?

[Denver Osborn]

Port 6000 is for X. You won't want to kill any of those processes. Instead have you looked into X11Forward if using ssh?

-denver

[Steven E. Protter]

Shalom,

Take a look at /etc/services

See if there is an entry for port 6000.

There is probably an application using the port. It seems to be a peristant application since it reconnects after boot.

Take a look at the source ip address: 10.132.121.51

Find out what application its running and perhaps talk to the user or sysadmin before trying to kill the application and disrupting things.

Or use a firewall to block port 6000, your choice.

SEP

[Abhishek Chauhan]

Hi Denver,
The 10.132.121.36 is not under production.Only 10.132.121.51 is being used.
So, we want to remove all these 10.132.121.36 sessions.
How can we check if X11 is using ssh?

Reg,
Abhishek

[Denver Osborn]

With your sshd_config you can check that "X11Forwarding yes" is there. However, if you have users connecting to dtlogin via xdmcp from something like reflection-x or xterms, setting up ssh to use X11Forwarding won't help. You'd still see established connections. I think you'd want to turn off xdmcp...

info to help you out there is on this thread...
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=945618

A lot of info available on the forums. You can search for things like port 6000, xdmcp and x11forwarding.

-denver

[Ludovic Derlyn]

hi,

just an idea for identify ports :

http://www.iana.org/assignments/port-numbers

regards

L-DERLYN