extra open ports in rkhunter

[Chuck Swiger]

Hi--

On Sep 18, 2010, at 4:27 PM, Carl Johnson wrote:
> The following are the ports if anybody has any ideas, but I would also like to know how to trace them down myself:
> 
> tcp4       0      0 *.876                  *.*                    LISTEN
> tcp6       0      0 *.921                  *.*                    LISTEN
> udp4       0      0 *.608                  *.*
> udp6       0      0 *.952                  *.*
> udp6       0      0 *.804                  *.*

Try:

  lsof -i tcp:876

...and so forth for the other ports; this will give you the process ID of whatever is holding that socket.

Regards,
-- 
-Chuck