From owner-freebsd-questions@FreeBSD.ORG  Sun Sep 19 02:45:30 2010
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id DF2EF106566B
	for <freebsd-questions@freebsd.org>;
	Sun, 19 Sep 2010 02:45:30 +0000 (UTC) (envelope-from cswiger@mac.com)
Received: from asmtpout025.mac.com (asmtpout025.mac.com [17.148.16.100])
	by mx1.freebsd.org (Postfix) with ESMTP id C88FC8FC08
	for <freebsd-questions@freebsd.org>;
	Sun, 19 Sep 2010 02:45:30 +0000 (UTC)
MIME-version: 1.0
Content-transfer-encoding: 7BIT
Content-type: text/plain; charset=us-ascii
Received: from [17.151.76.180] by asmtp025.mac.com
	(Sun Java(tm) System Messaging Server 6.3-8.01 (built Dec 16 2008;
	32bit)) with ESMTPSA id <0L8Z006SH3NBHM70@asmtp025.mac.com> for
	freebsd-questions@freebsd.org; Sat, 18 Sep 2010 19:45:11 -0700 (PDT)
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0
	ipscore=0 phishscore=0 bulkscore=0 adultscore=0 classifier=spam
	adjust=0
	reason=mlx engine=6.0.2-1004200000 definitions=main-1009180154
X-Proofpoint-Virus-Version: vendor=fsecure
	engine=2.50.10432:5.0.10011,1.0.148,0.0.0000
	definitions=2010-09-18_07:2010-09-18, 2010-09-18,
	1970-01-01 signatures=0
From: Chuck Swiger <cswiger@mac.com>
In-reply-to: <87pqwar5sc.fsf@oak.localnet>
Date: Sat, 18 Sep 2010 19:45:10 -0700
Message-id: <E0616266-D8C4-43CB-874D-1442CC4AE0F3@mac.com>
References: <87pqwar5sc.fsf@oak.localnet>
To: Carl Johnson <carlj@peak.org>
X-Mailer: Apple Mail (2.1081)
Cc: freebsd-questions@freebsd.org
Subject: Re: extra open ports in rkhunter
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 19 Sep 2010 02:45:31 -0000

Hi--

On Sep 18, 2010, at 4:27 PM, Carl Johnson wrote:
> The following are the ports if anybody has any ideas, but I would also like to know how to trace them down myself:
> 
> tcp4       0      0 *.876                  *.*                    LISTEN
> tcp6       0      0 *.921                  *.*                    LISTEN
> udp4       0      0 *.608                  *.*
> udp6       0      0 *.952                  *.*
> udp6       0      0 *.804                  *.*

Try:

  lsof -i tcp:876

...and so forth for the other ports; this will give you the process ID of whatever is holding that socket.

Regards,
-- 
-Chuck