Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In /etc/services on a few machines I've checked, port 9898 is associated with a service called MonkeyCom:

monkeycom   9898/udp     # MonkeyCom
monkeycom   9898/tcp     # MonkeyCom

The first reference I found in a google search for MonkeyCom says it's part of the Sasser virus. That seems like a misinterpretation to me -- it's more likely that Sasser is using 9898 but that there's some older service called MonkeyCom which originally got the assignment.

Who can tell me what MonkeyCom is?

share|improve this question
up vote 8 down vote accepted

MonkeyCom is (or was - as far as I can determine it is now defunct) a videophone/file transfer program.
As far as I can determine nothing legitimate is currently using port 9898 - it's pretty much just Sasser and a few other bits of nasty.

share|improve this answer
Do you have a source for that defunct videophone program or the reference to it? – Doug Harris Oct 8 '10 at 19:54… is the most authoritative one I found. The referenced site is long gone however & makes no mention of the MonkeyCom product. – voretaq7 Oct 8 '10 at 21:03
Old but still useful thread. -- Consider pgpool as a prime candidate to be the root-cause for this false positive. As suggested by @JoeVanDyk below, lsof | grep ":9898" or lsof -i :9898 may not reveal 'pgpool' even though its is installed as middleware and part of a posgresql setup. Better look at yr FW activity log to see what really makes yr 9898 TCP port look busy/open. nmap will sometimes report "monkeycom" as the associated application, a false positive for a "Dabber/Sasser" type worm infection (prevalent among M$ Win users). "False" as in it is really not there ! – Cbhihe yesterday

Tripwire Enterprise uses 9898 as it's default port for communication between server and agent.

share|improve this answer
I can conrirm that the tripwire agent is running on this port with an enterprise license on my machines. I would have voted up the first tripwire suggestion but don't have the rep points yet. – user180779 Jul 8 '13 at 21:07

pgpool might be using that port.

You can do a "lsof | grep 9898" and check.

share|improve this answer
Or lsof -i :9898 – mugen kenichi Oct 19 '11 at 12:51
+1 for mentioning pgpool. – Cbhihe yesterday

The definitive source for Port Assignments is IANA from which you can find a name and email address of someone who might know the answer to your question. More probably the email address is no longer valid :-(

share|improve this answer

Echoing RedGrittyBrick's point. Came across the same. MonkeyCom is a port association for a legitimate program which is likely also exploited in other instances.

Check out the following listing for a bit more detail

share|improve this answer

protected by Chris S Dec 29 '13 at 19:56

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.