How to block the culprit of the unknown port?
When I did a port scan nmap -p- localhost of my local system I found some unknown ports opened. I was using a closed source application when this happened and I known its this causing port opening. Everytime I open this software it uses a different port.
To find the process associated with the port I used sudo lsof -i TCP:48292
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
somefunc 12819 eka 3u IPv4 2132143 0t0 TCP localhost:48292 (LISTEN)
This closed source software is always using somefunc command to open random ports on everyrun.
How can I block this command from opening any more ports?
Edit: Its confirmed this closed source software is running somefunc. I found the source directory using pwdx 12819
linux networking security port
asked Jan 9 at 9:33
EkaEka
1287
add a comment |
When I did a port scan nmap -p- localhost of my local system I found some unknown ports opened. I was using a closed source application when this happened and I known its this causing port opening. Everytime I open this software it uses a different port.
To find the process associated with the port I used sudo lsof -i TCP:48292
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
somefunc 12819 eka 3u IPv4 2132143 0t0 TCP localhost:48292 (LISTEN)
This closed source software is always using somefunc command to open random ports on everyrun.
How can I block this command from opening any more ports?
Edit: Its confirmed this closed source software is running somefunc. I found the source directory using pwdx 12819
linux networking security port
asked Jan 9 at 9:33
EkaEka
1287
1
If I had no choice but to run it I would do so in a VM and firewall it to hell.
– davidgo
Jan 9 at 9:52
Depending on what this closed source application does, it may be perfectly legitimate behaviour, and blocking it may cause it to stop working. If you are worried, sandbox it (in a network namespace, or VM), and monitor the traffic to the sandbox to see if anything interesting happens.
– dirkt
Jan 9 at 11:58
@dirkt It may or may not be malicious. There are two reasons why I dont want this open port first it doesn't need any kind of connections for its normal function and second I have installed this closed soure app using root level. I will try to sandbox this can you recommend any good one?
– Eka
Jan 9 at 14:39
@Eka: How do you know for sure that it doesn't need any connections? The socket is not open to the network -- it is bound tolocalhost, which is very common for inter-process communications (i.e. between two components of the program, or between daemon and UI). (For the same reason, there's not much point in sandboxing it.)
– grawity
Jan 9 at 15:26
add a comment |
When I did a port scan nmap -p- localhost of my local system I found some unknown ports opened. I was using a closed source application when this happened and I known its this causing port opening. Everytime I open this software it uses a different port.
To find the process associated with the port I used sudo lsof -i TCP:48292
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
somefunc 12819 eka 3u IPv4 2132143 0t0 TCP localhost:48292 (LISTEN)
This closed source software is always using somefunc command to open random ports on everyrun.
How can I block this command from opening any more ports?
Edit: Its confirmed this closed source software is running somefunc. I found the source directory using pwdx 12819
linux networking security port
asked Jan 9 at 9:33
EkaEka
1287
When I did a port scan nmap -p- localhost of my local system I found some unknown ports opened. I was using a closed source application when this happened and I known its this causing port opening. Everytime I open this software it uses a different port.
To find the process associated with the port I used sudo lsof -i TCP:48292
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
somefunc 12819 eka 3u IPv4 2132143 0t0 TCP localhost:48292 (LISTEN)
This closed source software is always using somefunc command to open random ports on everyrun.
How can I block this command from opening any more ports?
Edit: Its confirmed this closed source software is running somefunc. I found the source directory using pwdx 12819
linux networking security port
linux networking security port
asked Jan 9 at 9:33
EkaEka
1287
asked Jan 9 at 9:33
EkaEka
1287
edited Jan 9 at 10:31
Eka
asked Jan 9 at 9:33
EkaEka
1287
asked Jan 9 at 9:33
EkaEka
1287
asked Jan 9 at 9:33
EkaEka
1287
1287
1
If I had no choice but to run it I would do so in a VM and firewall it to hell.
– davidgo
Jan 9 at 9:52
Depending on what this closed source application does, it may be perfectly legitimate behaviour, and blocking it may cause it to stop working. If you are worried, sandbox it (in a network namespace, or VM), and monitor the traffic to the sandbox to see if anything interesting happens.
– dirkt
Jan 9 at 11:58
@dirkt It may or may not be malicious. There are two reasons why I dont want this open port first it doesn't need any kind of connections for its normal function and second I have installed this closed soure app using root level. I will try to sandbox this can you recommend any good one?
– Eka
Jan 9 at 14:39
@Eka: How do you know for sure that it doesn't need any connections? The socket is not open to the network -- it is bound tolocalhost, which is very common for inter-process communications (i.e. between two components of the program, or between daemon and UI). (For the same reason, there's not much point in sandboxing it.)
– grawity
Jan 9 at 15:26
add a comment |
1
If I had no choice but to run it I would do so in a VM and firewall it to hell.
– davidgo
Jan 9 at 9:52
Depending on what this closed source application does, it may be perfectly legitimate behaviour, and blocking it may cause it to stop working. If you are worried, sandbox it (in a network namespace, or VM), and monitor the traffic to the sandbox to see if anything interesting happens.
– dirkt
Jan 9 at 11:58
@dirkt It may or may not be malicious. There are two reasons why I dont want this open port first it doesn't need any kind of connections for its normal function and second I have installed this closed soure app using root level. I will try to sandbox this can you recommend any good one?
– Eka
Jan 9 at 14:39
@Eka: How do you know for sure that it doesn't need any connections? The socket is not open to the network -- it is bound tolocalhost, which is very common for inter-process communications (i.e. between two components of the program, or between daemon and UI). (For the same reason, there's not much point in sandboxing it.)
– grawity
Jan 9 at 15:26
1
1
If I had no choice but to run it I would do so in a VM and firewall it to hell.
– davidgo
Jan 9 at 9:52
If I had no choice but to run it I would do so in a VM and firewall it to hell.
– davidgo
Jan 9 at 9:52
Depending on what this closed source application does, it may be perfectly legitimate behaviour, and blocking it may cause it to stop working. If you are worried, sandbox it (in a network namespace, or VM), and monitor the traffic to the sandbox to see if anything interesting happens.
– dirkt
Jan 9 at 11:58
Depending on what this closed source application does, it may be perfectly legitimate behaviour, and blocking it may cause it to stop working. If you are worried, sandbox it (in a network namespace, or VM), and monitor the traffic to the sandbox to see if anything interesting happens.
– dirkt
Jan 9 at 11:58
@dirkt It may or may not be malicious. There are two reasons why I dont want this open port first it doesn't need any kind of connections for its normal function and second I have installed this closed soure app using root level. I will try to sandbox this can you recommend any good one?
– Eka
Jan 9 at 14:39
@dirkt It may or may not be malicious. There are two reasons why I dont want this open port first it doesn't need any kind of connections for its normal function and second I have installed this closed soure app using root level. I will try to sandbox this can you recommend any good one?
– Eka
Jan 9 at 14:39
@Eka: How do you know for sure that it doesn't need any connections? The socket is not open to the network -- it is bound to
localhost, which is very common for inter-process communications (i.e. between two components of the program, or between daemon and UI). (For the same reason, there's not much point in sandboxing it.)– grawity
Jan 9 at 15:26
@Eka: How do you know for sure that it doesn't need any connections? The socket is not open to the network -- it is bound to
localhost, which is very common for inter-process communications (i.e. between two components of the program, or between daemon and UI). (For the same reason, there's not much point in sandboxing it.)– grawity
Jan 9 at 15:26
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1392207%2fhow-to-block-the-culprit-of-the-unknown-port%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1392207%2fhow-to-block-the-culprit-of-the-unknown-port%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
If I had no choice but to run it I would do so in a VM and firewall it to hell.
– davidgo
Jan 9 at 9:52
Depending on what this closed source application does, it may be perfectly legitimate behaviour, and blocking it may cause it to stop working. If you are worried, sandbox it (in a network namespace, or VM), and monitor the traffic to the sandbox to see if anything interesting happens.
– dirkt
Jan 9 at 11:58
@dirkt It may or may not be malicious. There are two reasons why I dont want this open port first it doesn't need any kind of connections for its normal function and second I have installed this closed soure app using root level. I will try to sandbox this can you recommend any good one?
– Eka
Jan 9 at 14:39
@Eka: How do you know for sure that it doesn't need any connections? The socket is not open to the network -- it is bound to
localhost, which is very common for inter-process communications (i.e. between two components of the program, or between daemon and UI). (For the same reason, there's not much point in sandboxing it.)– grawity
Jan 9 at 15:26