Re: port 6051: hacked?

["Nikolay Hristov" <geroy@mbox.stemo.bg>]

----- Original Message -----
From: "Ramin Motakef" <ramin@motakef.de>
To: <debian-security@lists.debian.org>
Sent: Friday, September 06, 2002 12:16 PM
Subject: port 6051: hacked?


> Hi all,
> Todays nmap run shows me:
>
> Interesting ports on  (xxxxxx):
> (The 59984 ports scanned but not shown below are in state: closed)
> Port       State       Service
> 21/tcp     open        ftp
> 22/tcp     open        ssh
> 25/tcp     open        smtp
> 53/tcp     open        domain
> 80/tcp     open        http
> 110/tcp    open        pop-3
> 111/tcp    open        sunrpc
> 143/tcp    open        imap2
> 199/tcp    open        smux
> 389/tcp    open        ldap
> 443/tcp    open        https
> 993/tcp    open        imaps
> 995/tcp    open        pop3s
> 3306/tcp   open        mysql
> 5432/tcp   open        postgres
> 6051/tcp   filtered    unknown    <--------------

'filtered' means that yoyr ISP or your firewall filters this port .. this is
not open port on your machine so there is nothing to worry about



>
> fuser -v 6051/tcp gives no result.
>
> Questions:
> Am i hacked?
> Is there any other way i can tell which program is responsible for
> this port?
> What exactly is the meaning of "filtered"?
>
>
> Info:
> System is running unstable, last upgrade 07-02-2002. Kernel 2.4.5.
> chkrootkit (latest debian) shows nothing strange .
>
> Thanks,
> Ramin
>

Nikolay Hristov