Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Have just run netstat -A on my SQL Server and seen an established connection from one of our workstations on bmcw000340.domain:close-combat.

My google-fu is failing me and I can't find out what close-combat is... does anyone know?

share|improve this question
    
Add the -n flag to get numeric output. Then you will see the port number (and the IP address) instead of the hostname and service description. –  Michael Hampton Jul 11 '12 at 7:43

3 Answers 3

up vote 2 down vote accepted

The translation that is done there (from port numbers to service names) is done using a lookup in your services file /etc/services. A very quick glance will show that a lot of information in there is entirely obsolete, and that it doesn't necessarily correspond to what is actually running or used on your machine.

If you want, you can change the service name in the services file to what your server is actually hosting there.

Additionally, bear in mind that with source port randomization, the service name of the source port is completely irrelevant, because it is random. Normally the ports chosen are supposed to be above 32767, but I typically don't observe this to be the case.

If you find the translation to be obfuscating rather than informative, simply specify the -n option to netstat; this will prevent lookup of both port numbers and rDNS. In theory, you could also trim irrelevant entries from /etc/services, though I wouldn't.

On windows this works exactly the same, except that the file is located at %WINDIR%\System32\drivers\etc\services.

share|improve this answer
    
it's a windows server box so /etc/services doesn't apply. do you know the equivalent for Windows? –  Paul D'Ambra Oct 21 '12 at 20:06
    
%WINDIR%\System32\drivers\etc\services –  Falcon Momot Oct 21 '12 at 23:44

Believe close combat was a game, way back when, people used to think their bit of software was important enough to have its own port, and for that port to appear in named lists :) As joequerty says, its not going to be "close combat" - especially (its not 100% clear) if it's the source port which is generally irrelevant.

share|improve this answer
    
+1 for the pointer... decided @Falcon got the answer for including how to find the mapping on the machine. –  Paul D'Ambra Oct 22 '12 at 9:34

It looks to be TCP and UDP port 1944:

http://www.iana.org/assignments/port-numbers

share|improve this answer
    
Was wondering more what close-combat was... What it's used by or for... –  Paul D'Ambra Sep 22 '10 at 11:38
    
Port 1944 is above the Well Known port numbers so it's probably a service or application that happens to run on port 1944 and is not actually close-combat, whatever that is. You can find out what service\application\process it is by running netstat -a -b -o which will list each connection, what process has established each connection, and what PID is responsible for each connection. –  joeqwerty Sep 22 '10 at 12:16
1  
Believe close combat was a game, way back when, people used to think their bit of software was important enough to have its own port, and for that port to appear in named lists :) As joequerty says, its not going to be "close combat" - especially (its not 100% clear) if it's the source port which is generally irrelevant. –  Tom Newton Sep 20 '12 at 18:24
    
@PaulD'Ambra Welcome to Server Fault. This question appears to have been answered; if you feel the answers are sufficient, please consider accepting an answer so that this question is considered resolved. Until you do so, it remains on the unanswered list and continues to come up. –  Michael Hampton Oct 21 '12 at 13:47
    
findports.com/document.php?tag=close-combat the game close combat doesn't use port 1944 –  Paul D'Ambra Oct 21 '12 at 20:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.