Re: port 6051: hacked?
to be totally sure, sniff and see which ICMP it returns if any ..
On Fri, Sep 06, 2002 at 02:46:22PM +0200, Nikolay Hristov wrote:
>
> ----- Original Message -----
> From: "Ramin Motakef" <ramin@motakef.de>
> To: <debian-security@lists.debian.org>
> Sent: Friday, September 06, 2002 12:16 PM
> Subject: port 6051: hacked?
>
>
> > Hi all,
> > Todays nmap run shows me:
> >
> > Interesting ports on (xxxxxx):
> > (The 59984 ports scanned but not shown below are in state: closed)
> > Port State Service
> > 21/tcp open ftp
> > 22/tcp open ssh
> > 25/tcp open smtp
> > 53/tcp open domain
> > 80/tcp open http
> > 110/tcp open pop-3
> > 111/tcp open sunrpc
> > 143/tcp open imap2
> > 199/tcp open smux
> > 389/tcp open ldap
> > 443/tcp open https
> > 993/tcp open imaps
> > 995/tcp open pop3s
> > 3306/tcp open mysql
> > 5432/tcp open postgres
> > 6051/tcp filtered unknown <--------------
>
> 'filtered' means that yoyr ISP or your firewall filters this port .. this is
> not open port on your machine so there is nothing to worry about
>
>
>
> >
> > fuser -v 6051/tcp gives no result.
> >
> > Questions:
> > Am i hacked?
> > Is there any other way i can tell which program is responsible for
> > this port?
> > What exactly is the meaning of "filtered"?
> >
> >
> > Info:
> > System is running unstable, last upgrade 07-02-2002. Kernel 2.4.5.
> > chkrootkit (latest debian) shows nothing strange .
> >
> > Thanks,
> > Ramin
> >
>
> Nikolay Hristov
>
>
> --
> To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
--
-> Jean-Francois Dive
--> jef@linuxbe.org
There is no such thing as randomness. Only order of infinite
complexity. - _The Holographic Universe_, Michael Talbot
Reply to: