TCP port 720

[Antonello]

Hi All
I'm trying to find which process keeps my tcp port 720 open on my Hp rp8400 - HP UX 11.11 box.
Lsof doen't helped me, no process listed on its output...really amazing

tcp 0 0 X.X.X.X.720 Y.Y.Y:Y.4036 ESTABLISHED
tcp 0 0 *.720 *.* LISTEN
connection was established from my Windows box with a telnet on 720 port.
lsof -i:720 give me no answer.

Any hint?

Thanks a lot

Antonello

[Simon Hargrave]

What output do you get if you do: -

telnet localhost 720 ... and then press return key a couple of times.

This may give a clue as to what's listening.

[Antonello]

Hi simon
blank screen, absolutely blank.....nor character neither output

Antonello

[Muthukumar_5]

Hai,

You can use the netstat -na | grep 720 to get the service details. You may see the foreign address on the net status or lsof details as like Y.Y.Y.Y.

Get the who -Ru | grep Y.Y.Y.Y and find it's termail type. Analyse the process which are running using ps -aelf | grep -v grep | grep 'tty type' It may give little informations.

Is there any service running on inetd.conf to support the queries on 720 port. Try to use the inetd with -l option to get the debug informations of service,if your 720 service is running. It will give some entries on syslog.log file.

if you do telnet localhost 720,it will give the error messages ( unable to connected ) or connected messages. Your previous response is varied from that?

you can use tusc to trace the process and it's behaviour.

Regards,
Muthukumar.

[Bharat Katkar]

Antonello,
looking at netstat -a ouput you will able to trace the IP address of the system who is using the port 720.
Then
# who -R | grep

This will give you the tty whose this IP address is
Then
# ps -t
This will list the processes running on that tty.
May be you will be able to trace out which process has opened that port.

I hope that should help.
Regards,

[Antonello]

Thanks for the replies
I try to simulate a connection to 720 tcp port from my Windows box with telnet 720, no way, blank screen , and on the server who -R dosn't give me any useful info, the connection mentioned above is not listed, it's not make a login session...

the only thing i see is that tcp port 720 is LISTENING ...

Antonello

[Jeff Schussele]

Hi Antonello,

According to iana.org ports 713-728 are unassigned so it could be *anything*.
Have you checked your /etc/services file to see if anything's been assigned to that port locally.
If it's not in inetd.conf then it has to be a daemon or such started up at boot time.
Check the /etc/inittab file as well as all /sbin/init.d scripts.
It has to be started up *somewhere*.

Good hunting,
Jeff

[Antonello]

Hi
someone told me that could ypbind , but the service is not running on our server.....
nothing of nothing looking at the /sbin/rc2.d

A

[Todd Whitcher]

I've had lsof not report processes in the past when I was using an older version. Verify you have a later version, it may help.

http://ftp.cerias.purdue.edu/pub/tools/unix/sysutils/lsof/binaries/

[Jeff Schussele]

Well - it could also be started up by an application script. Check to see just what's running app-wise on this system. Check the startups for the SW & quiz the application support team and developers to see is they've defined this port to be used by their app.

BTW - that lsof command should be:

lsof -i tcp:720

See if that gives you a better clue.

HTH,
Jeff

[Antonello]

Hi All
"rpcinfo -p " gave me the answer
Is the scopeux program used by Measureware that maps the service on a dynamic port.
In fact it became 709 yesterday, no more 720.

805306352 1 tcp 709

and i found from service list inside http://www.geocities.co.jp/SiliconValley/1667/PortScan.pdf:

"805306352 # HP measureware scopeUX "



when i run glance or gpm i see local connections on the bound port ( 720, 709, etc.)

Thansk anyway to all of you that replied.

Antonello