NON-SUMMARY: curious TCP port

From: Antonis Kyriazis !!! (antonis@intranet.gr)
Date: Wed Aug 12 1992 - 05:08:28 CDT


 ORIGINAL QUESTION
--------------------
I'm analyzing the output of a 'netstat -a' and by examining the line

< tcp 0 0 *.2041 *.* LISTEN >

I cannot find which process has initiated it...
[According to RFC1060, TCP port 2041 is associated with the service 'interbase'
(RDBMS?)!]

[ SS2, SunOS 4.1.2, X.25, le0, le1 ]

Any ideas? (thank you)
----------------------
        (END)

Thanks to kuhn@math.harvard.edu, trinkle@cs.purdue.edu, andy@autodesk.com
and miker@sbcoc.com.
Mike (miker@sbcoc.com) writes:
> Add the "-A" argument to get the PCB, then look up the PCB in pstat to
> get the file, then look at each process's file table (with pstat) to
> find out which process is using the socket (make some intelligent
> guesses so you don't actually have to look at every single process).

Well, 'rpcinfo -p' gives:

   program vers proto port
...
    100118 10 udp 2650 etherif
1342177279 1 tcp 2116 <- This was 2071 and 2041 and it changes
                                whenever I leave OpenWindows 3.0 and enter again
                                so ...

'netstat -A -a' gives:

PCB Proto Recv-Q Send-Q Local Address Foreign Address (state)
...
ff656d8c tcp 0 0 *.2116 *.* LISTEN
...

but pstat -ipf | grep ff656d8c gives nothing...

According to the man page, 'trpt' would give some info _if_ debug had been enabled...

So I decided to kill my processes one by one and I discovered that responsible for
the appearence of the line

< ff656d8c tcp 0 0 *.2116 *.* LISTEN >

in the output of 'netstat -A -a' was my entry

< ttsession -a xauth # starting ToolTalk message server >

in .xinitrc.

Furthermore 'rpcinfo -p' continues to report the line

< 1342177279 1 tcp 2116 >

although 'telnet zeus 2116' doesn't accept _anymore_ any connection!

Giving again 'ttsession -a xauth' results in

< 1342177279 1 tcp 2133 >

by rpcinfo -p (replaces the old one), the corresponding line appears in
'netstat -A -a' and the server accepts _again_ connections on this new (2133) TCP port.

This is all I found. I'll summarize any new information.
Thank you
+-------------------------------------------------------------------+
| Antonis Kyriazis |
| Networks & Communications e-mail: antonis@intranet.gr |
| INTRACOM sa |
| 19.5 km Marcopoulo Ave. fax: +30-1- 66 44 379 |
| Peania 190 02 +30-1- 66 43 718 |
| GREECE phone: +30-1- 66 44 961-5 |
| +30-1- 88 43 715 |
+-------------------------------------------------------------------+



This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:06:47 CDT