RE: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second

From: alfaentomega <alfaentomega(at)yahoo.com>
Date: Fri Dec 27 2002 - 03:36:29 EST

• Rob Shein <shoten@starpower.net> wrote:
  > Just to let you know, scanning localhost with nmap produces strange
  > results usually. Try scanning from another node before you go any
  > further.
  

I asked someone else to scan me. He told me that he doesn't see (and has never seen) such ports on his machine and that he doesn't see anything on mine, but after a while he found few random open ports on my host. I suppose it was because I was scanning myself at the same time, but when he told me that I indeed had open ports and that I should start comparing my /proc to ps output, I was sure I had been compromised. Now I know everything, thanks to Fyodor's answer.

Thanks.
-Alfaentomega.

---

Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now. http://mailplus.yahoo.com

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Fri Dec 27 12:12:01 2002