Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

when I make

nmap localhost

I get

22/tcp  open  ssh
25/tcp  open  smtp
111/tcp open  rpcbind
631/tcp open  ipp
646/tcp open  unknown

what is the port 646 ?

share|improve this question
up vote 5 down vote accepted

You should be able to see whats running on that port with

netstat -tunlp | grep 646 

From the comments

tcp     0     0*     LISTEN     2584/rpc.statd

This indicates that rpc.statd (PID 2584) is listening on port 646. The rpc.statd process is part of the implementation of NFS.

share|improve this answer
I get this tcp 0 0* LISTEN 2584/rpc.statd – JuanPablo May 12 '12 at 16:37
there goes your answer – sysfault May 12 '12 at 16:39
@JuanPablo: see the update to my answer. – Iain May 12 '12 at 16:44

Since the question has already been answered, I'll provide an answer with a little more background.

Nmap shows open ports by attempting to connect to them. If it receives a positive response, it reports the port as open, and gives a little more information (the SERVICE column) based on a table lookup in the nmap-services file. For ports that don't have an entry in that file, it reports unknown.

The operating system of the scanned machine knows all about what ports are open, since it has to handle the lower layers of network communication in order to hand the data off to the application (or program) that is listening for it. On Windows, Linux, and most *nix systems, users can get the information about open ports directly from the OS by using the netstat command. Further, with the -p option (-b on Windows), privileged users (e.g. root) can see the name and process ID (PID) that is using each port.

Nmap is not limited to looking up port information in nmap-services. When a user requests service version detection (-sV), Nmap sends data to the ports it discovers as open, then compares the responses to an extensive list of service fingerprints, generating more detailed information, like so:

646/tcp open  rstatd (rstatd V1) 1 (rpc #100001)
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.