Why is port 992 open ?

[bgroper]

I've done a fresh install of 14.2 with kde/plasma6.
(Slowly becoming familiar with lotsa gui stuff thats been moved to different place/s.)
Curious to know how port 992 becomes open.
If not needed, how to close it ?

# sockstat -l | grep 992
?        ?          ?     ?   tcp4   *:992                 *:*

 

[ShelLuser]

When in doubt check /etc/services to see what a port number is commonly used for:

peter@bsd:/home/peter $ grep -e "\s992" /etc/services
telnets         992/tcp    # telnet protocol over TLS/SSL
telnets         992/udp

It is a bit concerning to me that it's bound to your full stack and doesn't provide any information though, based on that and the info above I can't help but wonder if a check with chkrootkit and/or rkhunter wouldn't be a good idea just in case. Of course there could be valid reasons why the rest of the info is hidden.

 

[cy@]

lsof(8) and sockstat(1) are your friends.

 

[Andriy]

I'd guess (based on ?-s) is that this is a kernel service, likely NFS, using some random port picked by PRC port mapper.

 

[bgroper]

Thanks for replies.
Interesting that after a reboot, port 992 is not open. Yet.
I'll try to keep alert for any unusual port openings.