up vote 0 down vote favorite
share [g+] share [fb]

Using 'netstat -tulp' on my server box running under CentOS I have discovered strange listening ports 33363 (TCP) and 35661 (UDP). The thing is that 'PID/Program name' field for these ports contains nothing (dash actually). 'fuser -n tcp 33363' shows nothing. I have checked my box with chkrootkit and rkhunter utilities and it seems everything is O.K. Does anybody know what these sockets can be used for?

link|improve this question
feedback

2 Answers

up vote 2 down vote

Have you tried with lsof?

lsof -i TCP:33363
lsof -i UDP:35661
link|improve this answer
Thanks for reply! Like 'fuser' 'lsof' gives an empty output. – user14241 Jul 24 '09 at 8:35
Pretty weird... You can also try to trace the pid and see if it shows something interesting: strace -p <PID> – Fran Jul 24 '09 at 8:58
1  
What PID, Fran? – innaM Jul 24 '09 at 9:24
Doh! True, we do not know the pid. Thanks for pointing it out Manni :) – Fran Jul 24 '09 at 9:26
feedback
up vote 1 down vote

Did you run netstat -tulp as root?

link|improve this answer
Sure. :) Thanks for suggestion! – user14241 Jul 24 '09 at 8:37
Could have been the reason for the missing pid. You never know ;-) – innaM Jul 24 '09 at 9:22
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.