Re: dn6-nlm-aud started when apache starts

[Bob McClure Jr <robertmcclure earthlink net>]

On Mon, Jun 02, 2003 at 03:04:26PM +0200, Sergeyssels Wouter wrote:
> Hello,
>  
> I was wondering if it is normal that when I start Apache 1.3.27 on a
> Redhat 7.3 box port 195 also is used.
>  
> When I do a nmap on that system I see the following:
> 195/tcp    open        dn6-nlm-aud
>  
> When I stop Apache that is gone. Sometimes I get the following error
> when Apache is restarted:
> [Mon Jun  2 11:52:37 2003] [crit] (98)Address already in use: make_sock:
> could not bind to port 195
>  
> Anyone know what this is?
>  
> Thank you for your response.
>  
> Wouter Sergeyssels.

I just checked two such machines and "netstat -lpn|fgrep 195" doesn't
show anything.  Try that on yours.  Of course, if your box has been
cracked, netstat has likely been trojaned and won't show it.  You can
validate it with

  rpm -V net-tools

I've not heard of anyone monkeying with rpm or its database.

If it shows up in netstat, get the PID, pop up an xterm to full screen
and run

  ps auxfw | less

and search for that PID.  The "f" option orders things in a "family"
hierarchy.  Score one for the BSD variant of ps.  If you find the
actual executable that is running, you can see which RPM owns it with

  rpm -qf /path_to/the/binary

Cheers,
-- 
Bob McClure, Jr.             Bobcat Open Systems, Inc.
robertmcclure earthlink net  http://www.cumbytel.com/~bobcatos/
"In theory, practice and theory are the same, but in practice they are 
 different." - Larry McVoy