[expert] quick security question.

[dany allard]

 A friend of mine just setup his firewall with a striped down version of
Mandrake 7.2 using rc.firewall.

  The strange thing is that when I scan the machine (nmap) I see the
following port open.

31337/tcp  filtered    Elite

 The only use I know for that port is for back doors.

 Does anyone know of program in mandrake that would open that port?

Is it possible that the machine was hacked, within minutes of being
setup?

Is there something obvious that I am not seeing???

  Thanks in advance

  Dany Allard