Re: [OT] Re: BUG: Unusual TCP Connect() results.

[Alastair Poole <alastair@unixtrix.com>]

Kyle Moffett wrote:

> SSH and 3 RPC-based services, I would guess.  This is not a kernel
> bug, there are probably userspace applications which are opening
> those ports, even something as simple as an FTP client in active
> mode would do it.  Please run "netstat -lp" to determine which 
> processes have opened each port.

 >> These ports are definately not opened, yet still connect() returns 0 
with new kernels for ports
 >> that it should not.  I should have been more specific with nmap; 
even when specifying port ranges
 >> nmap still does not return these odd results upon a basic tcp scan.  
Only basic scanner like the ones
 >> mentioned and included in the first post.  No other RPC services or 
TCP daemons are running
 >> these are definately rogue ports.  Running on x86 and kernels 
2.6.11.10, 2.6.11.11 and 2.6.12-rc6
 >> the unusual results still persist when using these basic port 
scanners upon localhost.  I have someone
 >> else who has confirmed to me the same results.  Can anyone here?