Why is this port open?

[mufka]

This past weekend a new port showed up in scans of my Redhat 6.1 Apache server. The port is 6500 tcp. When I telnet to the port, it allows me to type but every time I hit enter, I get "command not foundsh:"

Any ideas on what this is?

 

[chiph]

I don't know, but it doesn't sound good.

Chip H.

 

[hnd]

Are you running some own Applications, may be a SQL-Server, any Internet Applications with server functionalities?....

hnd
hasso55@yahoo.com

 

[ackka]

http://www.ec11.dial.pipex.com/port-num4.htm#6500

6500 tcp udp boks BoKS Master dynas.se

http://www.netsys.com/firewalls/firewalls-9712/0012.html

http://www.boran.com/security/IT1x-7.html#Heading121

Some type of authentication server ? might be beinhg used as backdoor if you had no knowledge of it ???

good luck

ackka
ackka@mad.scientist.com

http://home.cyberarmy.com/ackka/

 

[mufka]

Just running Apache 1.3.9. The only ports that were open before were 21, 22 and 80.
This new port popped up out of nowhere after over a year of service.

 

[pmkincaid]

Run the command "lsof -i:6500", which will show you the process that is using the open port.

If you don't have lsof, you can also do "netstat -npa --inet" which will also give you the process - just not as much information.

Hope this helps,
Paul