From owner-freebsd-questions@FreeBSD.ORG Sun Sep 19 21:42:16 2010 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id A57A91065670 for ; Sun, 19 Sep 2010 21:42:16 +0000 (UTC) (envelope-from carlj@peak.org) Received: from redcondor2.peak.org (redcondor2.peak.org [69.59.192.56]) by mx1.freebsd.org (Postfix) with ESMTP id 7BBEE8FC14 for ; Sun, 19 Sep 2010 21:42:16 +0000 (UTC) Received: from peak-mail-gateway.peak.org ([69.59.192.41]) by redcondor2.peak.org ({e8dac926-1ec8-47e6-b410-31008b345fb7}) via TCP (outbound) with ESMTP id 20100919214214986 for ; Sun, 19 Sep 2010 21:42:14 +0000 X-RC-FROM: X-RC-RCPT: Received: from oak.localnet (207.55.91.197.peak.org [207.55.91.197] (may be forged)) by peak-mail-gateway.peak.org (8.12.10/8.12.8) with ESMTP id o8JLgESl031024 for ; Sun, 19 Sep 2010 14:42:14 -0700 (PDT) Received: from oak.localnet (localhost [127.0.0.1]) by oak.localnet (Postfix) with ESMTP id C852DCCC9 for ; Sun, 19 Sep 2010 14:42:13 -0700 (PDT) Received: (from carlj@localhost) by oak.localnet (8.14.4/8.14.4/Submit) id o8JLgDxE032958; Sun, 19 Sep 2010 14:42:13 -0700 (PDT) (envelope-from carlj@peak.org) X-Authentication-Warning: oak.localnet: carlj set sender to carlj@peak.org using -f From: Carl Johnson To: freebsd-questions@freebsd.org References: <87pqwar5sc.fsf@oak.localnet> <86tylmzb3j.fsf@gmail.com> <87hbhmqrfh.fsf@oak.localnet> Date: Sun, 19 Sep 2010 14:42:13 -0700 In-Reply-To: <87hbhmqrfh.fsf@oak.localnet> (Carl Johnson's message of "Sat, 18 Sep 2010 21:37:54 -0700") Message-ID: <87zkvdpg0a.fsf@oak.localnet> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.2 (berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Subject: Re: extra open ports in rkhunter X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Sep 2010 21:42:16 -0000 Carl Johnson writes: > Anonymous writes: >> Do you have some networking FS enabled (NFS, AFS, Coda, etc)? Perhaps, >> one of them listens for connections from kernel and is not associated >> with userland process. But it's just a guess. > > I have NFS enabled, but its processes are accounted for by both sockstat > and netstat. I decided to check out your idea anyways today, and it appears you were right. I disabled and stopped all NFS and rpc processes and those extra ports disappeared from the netstat listing. None of those ports are listed as related to anything, so I don't know what is going on. I had just experimented with NFS for a while, so I will just leave it off. Thanks for your suggestion. -- Carl Johnson carlj@peak.org