>
> A friend of mine just setup his firewall with a striped down version of
> Mandrake 7.2 using rc.firewall.
>
> The strange thing is that when I scan the machine (nmap) I see the
> following port open.
>
> 31337/tcp filtered Elite
This is the @home cable service provider blocking those ports so
that their vulnerable (ie: ignorant) customers don't get hacked into
by the most common backdoors.
They also block Netbus ports 12345 and 12346.
This answer was given to me by Fyodor, nmap's creator.
Thanks... Dan.