Trying to track down process bound to port ucp/513

Question

A security audit has detected one of our Solaris 8 servers(Generic_117350-38) has udp port 513 open. I've verified this using nmap and can even see it in netstat output, but can't track down which process is the culprit.
# netstat -an
UDP: IPv4
   Local Address         Remote Address     State
<snip>
      *.32775                               Idle
      *.513                                 Idle
<snip>
# nmap  -n -sU -p 513 10.65.11.228
Starting nmap 3.93 ( http://www.insecure.org/nmap/ ) at 2006-06-30 10:48 NZST
Interesting ports on 10.65.11.228:
PORT    STATE         SERVICE
513/udp open|filtered who
MAC Address: 08:00:20:EF:88:A4 (SUN Microsystems)
Nmap finished: 1 IP address (1 host up) scanned in 13.176 secondslsof shows only rlogin stuff on tcp/513:
inetd       556     root   16u  IPv6 0x30026f653e8        0t0       TCP *:513 (LISTEN)
in.rlogin 18394     root    0u  IPv4 0x3002785fcd8        0t2       TCP aklxd051-pub:513->aklxp061-pub.airnz.co.nz:729 (ESTABLISHED)
in.rlogin 18394     root    1u  IPv4 0x3002785fcd8        0t2       TCP aklxd051-pub:513->aklxp061-pub.airnz.co.nz:729 (ESTABLISHED)
in.rlogin 18394     root    2u  IPv4 0x3002785fcd8        0t2       TCP aklxd051-pub:513->aklxp061-pub.airnz.co.nz:729 (ESTABLISHED)
in.rlogin 24139     root    0u  IPv4 0x300557e3830        0t2       TCP aklxd051-pub:513->aklxd041-pub.airnz.co.nz:902 (ESTABLISHED)
in.rlogin 24139     root    1u  IPv4 0x300557e3830        0t2       TCP aklxd051-pub:513->aklxd041-pub.airnz.co.nz:902 (ESTABLISHED)
in.rlogin 24139     root    2u  IPv4 0x300557e3830        0t2       TCP aklxd051-pub:513->aklxd041-pub.airnz.co.nz:902 (ESTABLISHED)
rlogin    28865   oracle    5u  IPv4 0x300aaf8ef40   0t167482       TCP aklxd051-pub:975->aklxd041-pub.airnz.co.nz:513 (ESTABLISHED)
rlogin    28870   oracle    5u  IPv4 0x300aaf8ef40   0t167482       TCP aklxd051-pub:975->aklxd041-pub.airnz.co.nz:513 (ESTABLISHED)All servers have port udp/513 disabled by having the whod line commented out of /etc/services and /etc/inet/inetd.conf.
I've even stopped inetd temporarily and both nmap and netstat still show udp/513 as being idle/open.
All other servers show udp/513 as being closed and I can't find any difference on this one server.
Any help appreciated!

Answer 1

Hi,
Just to give you another angle, use the crash command to monitor the kernel memory caches. Gather output from this one every 12 or 24 hours so you can see a 'real' growth. Remember it is normal for these to grow somewhat, just not to the point that they eat up all system memory.
# crash
kmastatIf you notice a specific cache growing then you can use the kmausers command to see whats allocating into that cache:
Eg.
kmausers kmem_alloc_48HOWEVER before you can use kmausers you will have to have kmem_flags enabled. To do this add the following line to /etc/system and reboot:
Solaris 2.6 and before:
set kmem_flags=0x1f
Solaris 7 and above:
set kmem_flags=0x3f
Regards,
Ben Humphreys
Sun Australia - Solution Centre