From owner-freebsd-net@freebsd.org  Tue Sep 15 07:48:30 2015
Return-Path: <owner-freebsd-net@freebsd.org>
Delivered-To: freebsd-net@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 0C23AA036AB
 for <freebsd-net@mailman.ysv.freebsd.org>;
 Tue, 15 Sep 2015 07:48:30 +0000 (UTC)
 (envelope-from ohartman@zedat.fu-berlin.de)
Received: from outpost1.zedat.fu-berlin.de (outpost1.zedat.fu-berlin.de
 [130.133.4.66])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id BCEF41318
 for <freebsd-net@freebsd.org>; Tue, 15 Sep 2015 07:48:29 +0000 (UTC)
 (envelope-from ohartman@zedat.fu-berlin.de)
Received: from inpost2.zedat.fu-berlin.de ([130.133.4.69])
 by outpost.zedat.fu-berlin.de (Exim 4.85) with esmtp
 (envelope-from <ohartman@zedat.fu-berlin.de>)
 id <1ZbkyX-0017QH-Nw>; Tue, 15 Sep 2015 09:48:25 +0200
Received: from p578a69f9.dip0.t-ipconnect.de ([87.138.105.249]
 helo=freyja.zeit4.iv.bundesimmobilien.de)
 by inpost2.zedat.fu-berlin.de (Exim 4.85) with esmtpsa
 (envelope-from <ohartman@zedat.fu-berlin.de>)
 id <1ZbkyX-000gpy-Iy>; Tue, 15 Sep 2015 09:48:25 +0200
Date: Tue, 15 Sep 2015 09:48:24 +0200
From: "O. Hartmann" <ohartman@zedat.fu-berlin.de>
To: Xin Li <delphij@delphij.net>
Cc: freebsd-net@freebsd.org
Subject: Re: HELP! Mysterious socket 843/tcp listening on CURRENT system
Message-ID: <20150915094824.7021f0b2@freyja.zeit4.iv.bundesimmobilien.de>
In-Reply-To: <55F7C51D.4030704@delphij.net>
References: <20150915090658.1e0b9074@freyja.zeit4.iv.bundesimmobilien.de>
 <55F7C51D.4030704@delphij.net>
Organization: FU Berlin
X-Mailer: Claws Mail 3.12.0 (GTK+ 2.24.28; amd64-portbld-freebsd11.0)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-Originating-IP: 87.138.105.249
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net/>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Sep 2015 07:48:30 -0000

On Tue, 15 Sep 2015 00:13:33 -0700
Xin Li <delphij@delphij.net> wrote:

> 
> 
> On 9/15/15 00:06, O. Hartmann wrote:
> > Hopefully, I'm right on this list. if not, please forward.
> > 
> > Running CURRENT as of  FreeBSD 11.0-CURRENT #3 r287780: Mon Sep 14 13:34:16
> > CEST 2015 amd64, I check via nmap for open sockets since I had trouble
> > protecting a server with IPFW and NAT.
> > 
> > I see a service (nmap)
> > 
> > Host is up (0.041s latency).
> > Not shown: 998 filtered ports
> > PORT     STATE SERVICE
> > 843/tcp  open  unknown
> > 
> > and via sockstat -l -p 843, I get this:
> > ?        ?          ?     ?  tcp4   *:843                *:*
> 
> Sounds like there is a kernel listener, wild guess -- what does rpcinfo
> -p say?
> 
> Cheers,
> 

... lost contact to system, will reply as soon as I gain access ...