Red Hat ENTERPRISE LINUX 4 - SECURITY GUIDE Manual page 63

A more reliable way to check which ports are listening on the network is to use a port scanner such as
nmap.
The following command issued from the console determines which ports are listening for TCP
connections from the network:
nmap -sT -O localhost
The output of this command looks like the following:
Starting nmap 3.55 ( http://www.insecure.org/nmap/ ) at 2004-09-24 13:49 EDT
Interesting ports on localhost.localdomain (127.0.0.1):
(The 1653 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
22/tcp open ssh
25/tcp open smtp
111/tcp open rpcbind
113/tcp open auth
631/tcp open ipp
834/tcp open unknown
2601/tcp open zebra
32774/tcp open sometimes-rpc11
Device type: general purpose
Running: Linux 2.4.X|2.5.X|2.6.X
OS details: Linux 2.5.25 - 2.6.3 or Gentoo 1.2 Linux 2.4.19 rc1-rc7)
Uptime 12.857 days (since Sat Sep 11 17:16:20 2004)
Nmap run completed -- 1 IP address (1 host up) scanned in 5.190 seconds
This output shows the system is running portmap due to the presence of the sunrpc service.
However, there is also a mystery service on port 834. To check if the port is associated with the official
list of known services, type:
cat /etc/services | grep 834
This command returns no output. This indicates that while the port is in the reserved range (meaning 0
through 1023) and requires root access to open, it is not associated with a known service.
Next, check for information about the port using netstat or lsof. To check for port 834 using
netstat, use the following command:
netstat -anp | grep 834
The command returns the following output:
tcp 0 0 0.0.0.0:834
The presence of the open port in netstat is reassuring because a cracker opening a port
surreptitiously on a hacked system would likely not allow it to be revealed through this command. Also,
the [p] option reveals the process id (PID) of the service which opened the port. In this case, the
0.0.0.0:* LISTEN
Verifying Which Ports Are Listening
653/ypbind
51