Re: Services using Ports 1 & 6

[tony mancill <tony@mancill.com>]

On Sun, 14 Apr 2002, Noah L. Meyerhans wrote:

> On Sun, Apr 14, 2002 at 09:51:18AM -0500, David wrote:
> > Active Internet connections (servers and established)
> > Proto Recv-Q Send-Q Local Address           Foreign Address         State
> > PID/Program name
> > raw        0      0 0.0.0.0:1               0.0.0.0:*               7
> > -
> > raw        0      0 0.0.0.0:6               0.0.0.0:*               7
> > -
>
> These are not services listening on ports 1 and 6.  Look in the left
> column, where it says "raw".  The lines above indicate that you have
> something listening for raw ICMP (protocol 1) and TCP (proto 6) packets
> coming from any remote address to any local address.  Are you running
> something like portsentry, ippl, or iplogger?  If so, that's what you're
> seeing.

For a list of the IP protocols (in case you notice other raw sockets on
your box), see:

	http://www.networksorcery.com/enp/protocol/ip.htm#Protocol

HTH,
tony

  tony@mancill.com     |  An ounce of perception,
http://www.debian.org  |     a pound of obscure...
                       |        (Peart)


-- 
To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org