-----Original Message-----
From: Axalon Bloodstone <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED] <[EMAIL PROTECTED]>
Date: Wednesday, September 29, 1999 10:35 AM
Subject: Re: [expert] usage on ports 980-989 and 1000-1024 and syslog --MARK
>On Wed, 29 Sep 1999, Lee Wilson wrote:
>
>> I've noticed a few odd things in my logs and in my port usage, and I'm
curious
>> if these are normal and if so, what causes them. I am using Linux-Mandrake
6.0
>> (with updates)
>>
>> 1) In /var/log/messages I am getting at seemingly random intervals a message
>> that says, simply
>>
>> Sep 26 07:39:03 ad1440 -- MARK --
>
>Check those times it's not random.. then man syslogd /marker
thanks. that solves that problem.
>> 2) I am noticing random ports between 980-989 and 1000-1024 being used as
>> LISTENer ports. I cannot find any entries in /etc/services for these ports
and
>> don't know of a way to track down what process ID is using a specific port.
>> This is also happening on all 3 boxes, so I think it's probably normal.
>> Nonetheless, I'd like to know what is causing it.
>
>lsof -i, will identify whats useing what tcp ports.
lsof does not seem to be a standard package installed with Mandrake. But I
went out and got it from rpmfind.net. Very nice package. I wish I'd known of
it for the past several years. Oh well. Anyway, it showed me the following
(minus the irrevelant stuff):
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
rpc.statd 386 root 3u inet 540 UDP *:987
rpc.statd 386 root 4u inet 543 TCP *:989 (LISTEN)
rpc.rquot 396 root 3u inet 563 UDP *:997
rpc.mount 406 root 3u inet 583 UDP *:1006
rpc.mount 406 root 4u inet 586 TCP *:1008 (LISTEN)
rpc.mount 406 root 5u inet 591 UDP *:1011
rpc.mount 406 root 6u inet 594 TCP *:1013 (LISTEN)
rpc.mount 406 root 8u inet 599 UDP *:1016
rpc.mount 406 root 10u inet 602 TCP *:1018 (LISTEN)
So, what is this stuff? Why is rpc.[mount,statd,rquot] listening on several
different ports < 1024?
