Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

In /etc/services on a few machines I've checked, port 9898 is associated with a service called MonkeyCom:

monkeycom   9898/udp     # MonkeyCom
monkeycom   9898/tcp     # MonkeyCom

The first reference I found in a google search for MonkeyCom says it's part of the Sasser virus. That seems like a misinterpretation to me -- it's more likely that Sasser is using 9898 but that there's some older service called MonkeyCom which originally got the assignment.

Who can tell me what MonkeyCom is?

share|improve this question

5 Answers 5

up vote 6 down vote accepted

MonkeyCom is (or was - as far as I can determine it is now defunct) a videophone/file transfer program.
As far as I can determine nothing legitimate is currently using port 9898 - it's pretty much just Sasser and a few other bits of nasty.

share|improve this answer
    
Do you have a source for that defunct videophone program or the reference to it? –  Doug Harris Oct 8 '10 at 19:54
    
serverwatch.com/tutorials/article.php/10825_3521746_2/… is the most authoritative one I found. The referenced site is long gone however & makes no mention of the MonkeyCom product. –  voretaq7 Oct 8 '10 at 21:03

Tripwire Enterprise uses 9898 as it's default port for communication between server and agent.

share|improve this answer
    
I can conrirm that the tripwire agent is running on this port with an enterprise license on my machines. I would have voted up the first tripwire suggestion but don't have the rep points yet. –  user180779 Jul 8 '13 at 21:07

pgpool might be using that port.

You can do a "lsof | grep 9898" and check.

share|improve this answer
    
Or lsof -i :9898 –  mugen kenichi Oct 19 '11 at 12:51

The definitive source for Port Assignments is IANA http://www.iana.org/assignments/port-numbers from which you can find a name and email address of someone who might know the answer to your question. More probably the email address is no longer valid :-(

share|improve this answer

Echoing RedGrittyBrick's point. Came across the same. MonkeyCom is a port association for a legitimate program which is likely also exploited in other instances.

Check out the following listing for a bit more detail

share|improve this answer

protected by Chris S Dec 29 '13 at 19:56

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.