about nmap

[Peter Rosa]

> When I find something open and check
> it again, it is closed. And... cannot
> close "syslogd" for report issues.

At least, can not you run syslogd with syslogd_flags="-ss" in /etc/rc.conf ?
It disables listening on 514 at all, but still works locally.
Do not use it, if your machine is used as syslogd "file server" for other
machines !


And what about some milter ? It could open some local connections on high
ports. Do not you have some kind of antispam system on your machine ? Or
DansGuardian or something like ?


Have you tried to run "sockstat >> /some/file" every minute from cron and
try to find which process opens the port ?


Peter Rosa