Shut off port 49152

[Lonny Balderston]

On HP-UX 11.11 RP5470, Security has us shutting off certain ports. In this case, suspect is 49152:
# netstat -an | grep LISTEN | grep 49152
tcp 0 0 *.49152 *.* LISTEN
# grep ":49152" crashinfo.txt
fd=18 file=0x514852c0 vnode=0x6de2e808: VNFS_SPEC/VCHR v_data=0x6de2e800 v_rdev=0x15400001 sth=0x6e1dfb80 tcp_t=0x6e222528 L=*:49152 (LISTEN) ip ipc_t=0x6e1dbb68 /dev/tcp

Any idea what this is and how to shut it off?
Thank you for your support.

[Sandman!]

Use lsof to determine the process that is listening on port 49152. lsof can be obtained from http://hpux.cs.utah.edu/

[A. Clay Stephenson · Accepted solution]

This will be a bit tricky and almost certainly 49152 is not the port that you want to shutdown --- at least, not directly and if you did, it wouldn't help more than momentarily. Ports starting at 49152 and up are the so-called anonymous, dynamic, or private ports. Normally a connection is established by a listener on a port in the registered range (1024-49151) and then the connection is handed off to the first available dynamic port and the listener goes back to listening for new connections at the dedicated port in the registered range. You need to use netstat or lsof to look for the dedicated port in the lower range. If you are lucky, the dedicated listener forks a process for the dynamic port so that the parent process is the one that you need to control.