SOLVED TCP Port 942?

[cablet]

Greetings,
I'm running 9.3-Stable and have three jails (Plex, Minecraft, and openVPN). I also have shares as NFS, CIFS and AFP. After getting a security email from the system that in the middle of the night one of my workstations attempted to ssh in as root on port 54560 I started digging around (as well as changing some passwords just to be safe). Port 54560 is closed. I've scanned the system for all open ports and the only one I can't account for is TCP port 942. Does anyone know what this port would be used for? I can't seem to find anything concrete on the web about this one.

Thanks for any info.

 

[DrKK]

You can see all of your open ports by dropping to shell and typing

Code:

sockstat -4

.

The will give a lot of entries, but look for entries like this one:

Code:

root  nginx  2932  9  tcp4  192.168.1.21:80  *:*

where it shows *:* in the last column. In this case, this shows that port 80 is open and listening, and that nginx controls that socket.

 

[cablet]

Thank you. Very handy command 'sockstat -4'.
Port 942 is being used by rpc.statd which is part of NFS.

 

[jgreco]

54560 was almost certainly the port number on the initiating machine, not on the NAS. The NAS could have no possible way to know that it was an SSH client trying to make a connection from the initiating machine.

You might try to remember if maybe you ssh'd into the NAS.