rpcinfo program 1073741824

[tsunix-pdm-1]

Hello,

I want to know what service is this and what is it for:

1073741824  1         tcp                              -           superuser

from rpcinfo:

server04:/root:rpcinfo -s
   program version(s) netid(s)                         service     owner
    100000  2,3,4     udp,tcp,ticlts,ticotsord,ticots  rpcbind     superuser
    100021  4,3,2,1   tcp,udp                          nlockmgr    superuser
    100024  1         ticots,ticotsord,ticlts,tcp,udp  status      superuser
    100133  1         ticots,ticotsord,ticlts,tcp,udp  -           superuser
1073741824  1         tcp                              -           superuser
    100166  1         ticotsord                        -           superuser
    100231  1         ticots,ticotsord,ticlts          -           superuser
    100005  3,2,1     ticots,ticotsord,tcp,ticlts,udp  mountd      superuser
    100003  3,2       tcp,udp                          nfs         superuser
    100227  3,2       tcp,udp     

Best Regards,

[Matti_Kurkela]

First, it seems to be none of the IANA-assigned standard RPC protocol numbers:

http://www.iana.org/assignments/rpc-program-numbers/rpc-program-numbers.xml

Second, trying to google for "rpc protocol number 10737418242":

Inconclusive. It seems it might be used by various software that does not have a standard RPC protocol number assigned. Some hits were:

• a "TIBCO staffware program"
• dtcm, a calendar tool included with CDE desktop environment
• ArcStorm database engine
• somewhere it was mentioned that this belongs to a "dynamic range" of rpc protocol numbers, so it might be impossible to identify by the protocol number only.

The third option: you'll need to find it out yourself. Start with running

rpcinfo -p

 It will display the protocol (tcp/udp) and port number used by each RPC protocol registered on your system. Find out the port number that is currently used by this mystery RPC protocol. From your "rpcinfo -s" output, we already know it uses TCP protocol only.

The next step would require having the "lsof" utility installed. For all HP-UX 11i versions, it is included in the "HP-UX Internet Express" CD that seems to be included in every HP-UX installation media kit. If you don't have it, the Internet Express kit is available as a free download for HP-UX 11.23 and 11.31 at software.hp.com: you'll only need the ixLsof depot. Alternatively, look here:

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/lsof-4.84/

If you have the lsof utility installed, run lsof -i tcp:<port number> to find the PID of the process using that port. Then you can use ps -fp <PID> to see the full name of the process, and/or lsof -p <PID> to see the current working directory  (cwd in the FD column) and the program binary pathname (txt in the FD column) of the process. These should be very helpful in identifying the process.

For example, if the program binary pathname is something like /opt/<something>/bin/<somebinary>, you might look in directory /opt/<something> and see if it has any README, LICENSE or similar files that look like human-readable text, or helpful sub-directories like "doc", "docs", or "man". Usually these are parts of the application documentation, and include at least the full name of the application at some point.

[tsunix-pdm-1]

Hi,

The problem is I am unable to identify what is listening in that port:

#rpcinfo -p
   program     vers proto   port   service
...
1073741824    1   tcp    49153

#netstat -an | grep 49153
tcp        0      0  *.49153                *.*                     LISTEN

#/usr/local/bin/lsof -i:49153
#

I have seen in several systems (and in several rpcinfo outputs in the internet) the same. They are asking for allowing or not this port in the firewall, but so far I don't know what to tell them.

Best Regards,

[Dave Olker · Accepted solution]

I used lsof to figure this out.  I downloaded lsof from:

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/lsof-4.84/

After installing lsof I ran it with the -i option, which prints out the internet connections and who owns them.  Here's how things map on my system:  

# rpcinfo -p | grep -E '1073741824|port'
program vers proto port service
1073741824 1 tcp 49157

On my system RPC program 1073741824 is listening on port 49157.  Using lsof:

atcux12(/tmp) -> lsof -i | grep 49157
nfs4cbd 1351 root 7u IPv4 0xe0000003cf24d480 0t0 TCP *:49157 (LISTEN)

This is the NFS v4 Callback daemon. 

# man nfs4cbd

nfs4cbd(1M)

NAME
nfs4cbd - NFS Version 4 callback daemon

SYNOPSIS
/usr/sbin/nfs4cbd

DESCRIPTION
The nfs4cbd daemon manages communication endpoints for the NFS Version
4 protocol callback program. nfs4cbd runs on the NFS Version 4 client
and creates a listener port for each transport over which callbacks
can be sent.

The nfs4cbd daemon is provided for the exclusive use of the NFS
version 4 client.

If you want rpcinfo to display a "nicer" version of the output you can add an entry to /etc/rpc:

nfs4cbd         1073741824

Then the rpcinfo output looks a little easier to understand:

# rpcinfo -p | grep -E '1073741824|port'

program vers proto port service
1073741824 1 tcp 49157 nfs4cbd

Hope this helps,

Dave

[tsunix-pdm-1]

Hi,

Finally I have it. I have replaced my lsof version (4.82 --> 4.84) and now I am able to see the process, as Dave found:

#/usr/local/bin/lsof -i:49153
COMMAND    PID   USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
rpc.statd 1127 daemon    6u  IPv4 0xe000000313aba480      0t0  UDP *:49153 (Idle)
nfs4cbd   1152   root    6u  IPv4 0xe000000312c15200      0t0  TCP *:49153 (LISTEN)
#

Thank you very much for the help to both!

Best Regards,

[Dennis Handly]

>nfs4cbd         1073741824

1073741824 is 0x40000000 if that means anything.