Random UDP port open.

I ran a port scan on my machine, I fount that everything is how I like it - save for one UDP port that was open. And yet, according to lsof, nothing. The strange part is that each time I scan, it's always random, on a different port. (note: no nameserver running)

Quote:

---

# nmap -p 0-65535 -sS -sU localhost

Starting Nmap 4.11 ( Nmap - Free Security Scanner For Network Exploration & Security Audits. ) at 2010-02-13 18:36 EST
Interesting ports on localhost.localdomain (127.0.0.1):
Not shown: 131065 closed ports
PORT STATE SERVICE
25/tcp open smtp
80/tcp open http
443/tcp open https
993/tcp open imaps
57526/udp open unknown

Nmap finished: 1 IP address (1 host up) scanned in 8.162 seconds
# nmap -p 0-65535 -sS -sU localhost

Starting Nmap 4.11 ( Nmap - Free Security Scanner For Network Exploration & Security Audits. ) at 2010-02-13 18:37 EST
Interesting ports on localhost.localdomain (127.0.0.1):
Not shown: 131065 closed ports
PORT STATE SERVICE
25/tcp open smtp
80/tcp open http
443/tcp open https
993/tcp open imaps
40756/udp open unknown

Nmap finished: 1 IP address (1 host up) scanned in 8.418 seconds

---

What do you think this could be from?

I think this it the famous whack-a-mole UDP port problem.



:p :p :p

'netstat -aup' should show you which process that owns the port

No luck, 'netstat -aup' doesn't reveal anything lsof didn't.

it is netstat -aop

No, Mike is right. -u checks for UDP sockets, -o displays timers. Why would I care about timers if I can't even see the socket?

Maybe we should employ a numerologist to see if there is anything special about those port numbers?

Quote:

---

Displays protocol statistics and current TCP/IP network connections.

NETSTAT [-a] [-e] [-n] [-o] [-s] [-p proto] [-r] [interval]

-a Displays all connections and listening ports.
-e Displays Ethernet statistics. This may be combined with the -s
option.
-n Displays addresses and port numbers in numerical form.
-o Displays the owning process ID associated with each connection.
-p proto Shows connections for the protocol specified by proto; proto
may be any of: TCP, UDP, TCPv6, or UDPv6. If used with the -s
option to display per-protocol statistics, proto may be any of:
IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, or UDPv6.
-r Displays the routing table.
-s Displays per-protocol statistics. By default, statistics are
shown for IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, and UDPv6;
the -p option may be used to specify a subset of the default.
interval Redisplays selected statistics, pausing interval seconds
between each display. Press CTRL+C to stop redisplaying
statistics. If omitted, netstat will print the current
configuration information once.

---

mine no have -u opps.

i have theory if you like hear. your isp may use those udp ports to slip their advertisements on to your computer.meow i set up a listener on some udp ports to see why they were open. i did get a connect with the isp sending advertisements. fwiw