[SOLVED] strange port open after install

mikudo · 08-27-2018, 09:29 AM

Hi,

I am trying out new OS's and considering Centos 7.

I installed openvpn after running yum update and then installed nmap and scanned localhost for giggles.

Port 50500 was open, I said, waa? I am used to the rpc, smtp, and 631 but 50500? An obscure port? No known service associated with this.

I grepped services and ps but no hits.

It was open for another couple minutes then closed on its own?

Can anyone explain to me what this was?

tia

smallpond · 08-27-2018, 01:18 PM

Use netstat (or ss) to find the process. Example:

Code:

sudo netstat -tpn |grep 49982
tcp        0      0 10.189.49.244:49982         72.37.164.112:80            ESTABLISHED 15168/firefox

Turbocapitalist · 08-27-2018, 01:46 PM

The nmap scan must be done from another machine so that it will show what is really visible to the outside. Scanning from the same machine will show localhost among other things. The localhost / loopback address is for all kinds of internal communication among activities on your machine. If set up correctly they are not in any way communicating with the outside. In order to see what actually is on the outside the scan, too, must be done from another machine.

mikudo · 08-28-2018, 02:20 AM

Thank you these two responses are helpful, however, do you have a short list of things that port 50500 might have been, internally communicating?

Turbocapitalist · 08-28-2018, 02:56 AM

You can check /etc/services on machine to see if anything is registered, but I doubt you will find something. IANA has a list called the Service Name and Transport Protocol Port Number Registry available in a number of formats. But those are mostly just guidelines, even if people do generally adhere to them closely.

Again, if it is a localhost to localhost connection it is just your system talking to itself so meaningful security scans can only come from a second computer. However, if you are fast enough with netstat you might see the program name though.

Habitual · 08-28-2018, 10:56 AM

wrt: 50500
Alfresco...?

Next time it is "Open" try

Code:

sudo lsof -i :50500