Re: NFS creates hidden port

["Thomas Schmitt" <scdbackup@gmx.net>]

Hi,

i wrote:
> > E.g. try to patch unhide-tcp so that it reads the NFS port number from
> > a file which you create before the Rkhunter run.

Rob van der Putten wrote:
> I would have to find out when NFS does a callback an then dump the local
> port into a file.

Earlier:
> > > The hidden port lingers on for days. Until one restarts NFS.
> > > NFS then uses an other port which clearly shows in netstat,
> > > until it becomes hidden again.

One could make a script which determines and records the port number
as long as it is visible. When it vanishes from netstat, then one would
stay with the recorded number until the NFS port re-appears in netstat
again.


> It's the client side of RPC NFS callback. 

Question is whether it can be unambiguously recognized in netstat output
as long as it is visible.
Further: Is it always only one hidden port ?


Have a nice day 

Thomas