Re: which server is bound to which port

[Jack Barnett]

----- Original Message -----
From: Richard Adams <[EMAIL PROTECTED]>
To: Jack Barnett <[EMAIL PROTECTED]>
Cc: <[EMAIL PROTECTED]>
Sent: Friday, May 12, 2000 8:58 AM
Subject: Re: which server is bound to which port


> On Fri, 12 May 2000,  Jack Barnett wrote about,  Re: which server is bound
to which port:
> > > how do you find it.??
>
> Any program running as aprocess will show up in the output of ps.
> Or any program running via inetd will be in /etc/inetd.conf.
>
> >
> > I was learn socket programming in perl and created port scan script to
learn
> > how to connect, etc and it showed up, I telented there and it made a
> > connection, but when I typed something it disconnected me.  It didn't
print
> > anything out
>
> Now i would like a copy of that script if at all possable, perl is not a
> friend of mine but i am trying to get to know her, a sample script of this
> type will help me a lot.

#!/usr/bin/perl -w

# your host.domain.com name or IP
$ip = "host.domain.com";

# what port to scan scaning on
$start = 1;

# which port to stop scanning on
$end = 300000;

# shouldn't need to change anything below this line

# unbufferd output, so we have so idea of what it is doing...
$| = 1;

$ports[0] = "0";
use IO::Socket;

while ($start < $end)
 {
   $socket = IO::Socket::INET->new(PeerAddr  => $ip,
       PeerPort => $start,
       Proto => "tcp",
       Type  => SOCK_STREAM);
   if( $socket )


      print("\nconnection on $ip\:$start\n");
      close($socket);
      $ports[@ports] = "$start";
    }
   $start++;
   print ("."); # so we atleast know it didn't hang
 }

print ("\n\nPorts found:\n\n");
foreach (@ports)
 { print ("$_\n"); }


> > >who starts it,??
> >
> > Not sure, I don't even know what program is bound to that port, that is
what
> > I am trying to firgure out
> >
> > > that can be seen with 'ps ax'.
> >
> > I looked though that and they all looked like processes that should of
be
> > running, I even started killing a lot of them just to make sure, and
still
> > couldn't find it.
> >
> > > Are you seeing the port in some sort of trace program.??
> >
> > Yea
> >
> > >  port 1616 could
> > > well be used by the inet server.
> >
> > I shutdown the inetd and it was still accepting connections to that port
> >
> > > Is port 1616 defined in your /etc/services, ??
> >
> > no
> >
> > > do you run any spesific
> > > programs via inetd, check in /etc/inetd.conf.??
> >
> > no
>
> What i think it is, is quite possably a program transmitting on port 1616
> to another port on another server, so possably a senario would be;
>
> A telnet session you start could send packets on port 1616 to -> 23 on
> another machine.
>
> A sample transmit packet could look like.
>
> IP: len 52 44.137.28.27->44.137.28.48 ihl 20 ttl 64 DF prot TCP
> TCP: 1082->telnet Seq x6d6932b7 Ack x6f967c42 ACK Wnd 1888
>
> Note 1082 goes to 23
>
> So 1082 could well be 1616 on your system.
>
> This is a paritial packet from a trace of 2 ampr.org stn's via an SCC
> interface, however the underlying protocol is the same.
>
> --
> Regards Richard
> [EMAIL PROTECTED]
> http://people.zeelandnet.nl/pa3gcu/
>

I will check that out, thanks, it might be like an outgoing ftp connection
downloading something.

Thanks,
Jack


-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in
the body of a message to [EMAIL PROTECTED]
Please read the FAQ at http://www.linux-learn.org/faqs