[SOLVED] Port 9001. What is it? (and a conky question)

Question

I've been screwing with my conky for the last few days, whenever boredom struck.
An ingenius idea befell me, to use my conky as a port monitor; to try and detect anything/anyone that connects, or tries to connect, regardless of whether or not my ports are in stealth mode (as they are thanks to the Arch Wiki, with its iptables and ufw pages).
I punched up the following line into my conky:
IP: ${tcp_portmon 1 65535 rip 0 9} Port: ${tcp_portmon 1 65535 rport 0 9}
Based on the Conky Objects table at this site:
http://conky.sourceforge.net/variables.html
According to this site, I read something about UDP Protocol 9001:
http://www.auditmypc.com/udp-port-9001.asp
But that did little to explain what my conky reported back to me:
It reported back a remote IP on port 9001
I believed it COULD be Tor according to wikipedia:
http://en.wikipedia.org/wiki/List_of_TC … rt_numbers
But after trying to restart Tor daemon, I discovered I don't have Tor installed anymore. SOMEHOW. I do NOT recall removing Tor from my rc.d. >.>
I decided to go here and probe test port 9001:
https://www.grc.com/x/portprobe=9001
I received a "Stealth" result from the probe test.
Finally, I searched ETL Service Manager and learned that its a protocol.
Bottomline is... why is my conky giving me a remote IP read out on port 9001?
It's really starting to freak me out.
Last edited by MLawrence (2012-01-28 04:33:53)

Answer 1

Well, don't I feel like a dog chasing his own tail.
I DO have Tor installed. When I performed my daemon and package queries I searched "Tor" instead of "tor", so naturally I didnt find anything.
tor and dropbox were the established connections shown after running: sudo lsof -i| grep ESTABLISHED
When i killed dropbox in my system tray, the tor connection disappeared too. I guess this implies that dropbox was connected through tor.
Thank you for your help.