other mysterious port things

[Jogi Hofmueller <jogi@mur.at>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

hi!

lately i was running nmap to check my office machine. to my surprise i
found an open port 'cadsi-lm' (1387). running nmap again the port was not
there anymore. on future runs i found my machine listening on different
registered non-privileged ports but i never found any daemon nor nothing
with lsof. the event is not reproduceable. the same port never shows up
again. tcpdump didn't produce any helpful output.

i checked various security sites if there is anything known about a 'worm'
or backdoor that shows a behaviour like this. nothing.

so my question: has anyone ever noticed something like this? could it be a
bug in nmap (i'm using V. 2.12 from debian/potato which seems to be the
newest version)?

thanx for replies
j.

- -- 
		-------------------------/
					/ 	 /"\                         /
j		http://www.mur.at/~jogi/	 \ /  ASCII RIBBON CAMPAIGN /
 o		GSM: +43-676-34 12 198/		  X   AGAINST HTML MAIL    /
  g				     /		 / \  AND POSTINGS        /
   i____________hofmueller__________/

Look for public key at my homepage ...
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (GNU/Linux)
Comment: Made with pgp4pine

iD8DBQE7E32LAPrjdblyzsERAuc3AJ9MZevk0UQQFbrIaR4icKNseOdvfgCfTNPW
Q6068cE/OanPLpxL77dpKqQ=
=iirb
-----END PGP SIGNATURE-----