Hello,

I have a number of Solaris 8 Sun servers that have open ports that I cannot identify. I see some with 1012-1020 (which are reserved ports according to the IANA. Lsof does not identify these. One server has all these on and one server just has 1017.

*.1023 Idle
*.1022 Idle
*.1021 Idle
*.1020 Idle
*.1019 Idle
*.1018 Idle
*.1017 Idle
*.1016 Idle
*.1015 Idle
*.1014 Idle
*.1013 Idle

I also have Disksuite running on 2 of the servers and I see strange ports opened by inetd. Some research indicates that this could be from a Disksuite metatool, but it isn't on all the servers.

# *lsof -i :36724*
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
inetd 247 root 13u IPv4 0x30004c18638 0t0 TCP *:36724 (LISTEN)

# *lsof -i :36725*
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
inetd 247 root 14u IPv4 0x30004c184b8 0t0 TCP *:36725 (LISTEN)

# *lsof -i :50689*

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
inetd 210 root 13u IPv4 0x30001a2be38 0t0 TCP *:50689 (LISTEN)

# *lsof -i :50690*
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
inetd 210 root 14u IPv4 0x30001a2b3b8 0t0 TCP *:50690 (LISTEN)

But then I have another server which isn't running Disksuite that has a similar port open.

# *lsof -i :32769*
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
smcboot 265 root 3u IPv4 0x300001470b0 0t0 TCP *:32769 (LISTEN)

Any ideas please?

Thanks

I rebooted one server and all the 1013-1023 ports closed. I did notice on one server that port 1017 indicates it is BOUND in netstat but I cannot find (using LSOF) what that would be bound to.

Any suggestions please?

Thanks

For the ports in my inquiry 36724/36725 and 50689/50690, I commented out the entries in inetd.conf that the disksuite install set up for Metatool GUI and HUP inetd. Those ports went away. I use the command line and don't need it.

---
100229/1 tli rpc/tcp wait root /usr/sbin/rpc.metad rpc.metad

100230/1 tli rpc/tcp wait root /usr/sbin/rpc.metamhd rpc.metamhd

Now if anyone knows about those 1017 BOUND port, that would be great.

Thanks

As I said in my prior post, I rebooted the server and they shut down but this morning I looked and they were all open again. They are not listed in /etc/services. Any suggestions or tools would be appreciated.

Thank you.

*.1023 Idle
*.1022 Idle
*.1021 Idle
*.1020 Idle
*.1019 Idle
*.1018 Idle
*.1017 Idle
*.1016 Idle
*.1015 Idle
*.1014 Idle
*.1013 Idle