Results 1 to 6 of 6

Thread: UDP scan on Linux port 31337

  1. #1
    Senior Member
    Join Date
    Feb 2002
    Posts
    130

    UDP scan on Linux port 31337

    Hi people,
    I have just been to the Sygate website and done a UDP port scan on my machine. It showed port 111 open, which is understandable, I haven't configured any firewall yet, but it also showed port 31337 open. I find it quite hard to believe I have got BO on my machine, I mean its a Mandrake Linux box for a start (8.2) and I have just rebuilt it 15 mins ago. Any ideas??? it's got me confused

  2. #2
    Senior Member
    Join Date
    May 2002
    Posts
    450
    you haven't installed portsentry by any chance ?

    that will show port 31337 open - only to catch the bad guys and add them to the hosts.deny file.

  3. #3
    Senior Member
    Join Date
    Feb 2002
    Posts
    130
    Not unless it installs as standard on Mandrake, which I dont think it does, I will check in a minute though just to make sure. I have just downloaded Nmap3.0 now to check it myself and it says the port is closed when I run the scan against the loopback address, take it this should show if its open, it shows the SunRPC port open which the Sygate scan detected.

  4. #4
    Senior Member problemchild's Avatar
    Join Date
    Jul 2002
    Posts
    551
    I can't really think what might be causing it, but I can assure you it's not normal based on the 100+ installs I've done of Mandrake over the years. Try using netstat to see what's listening on that port. Like PP said, you may have portsentry running, which will bind itself to certain ports and watch for port scans, so it may be listening on the BO port.

    That's all I can think of, unless you really do have a trojan.
    Do what you want with the girl, but leave me alone!

  5. #5
    Junior Member
    Join Date
    Aug 2001
    Posts
    6
    Hi,

    try netstat -lap as root. It will tell you which app is listening on that particular port. hope this helps.

    moch
    ~ Moch ~

  6. #6
    Senior Member
    Join Date
    Feb 2002
    Posts
    130
    Thanks for your help everyone, I have still been anuable to find the cause of the report from the sygate site. I am resonably satisfied everything is ok with my box though, several local nmap scans, netstats and virus scans later and I cannot see it reporting open anywhere. The netstat command mochacin0 gave reports connections to lots of ports, and ports listening that the local scan didn't pick up. Anyway, like I said I am pretty confident I have no trojan... phew....

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •