Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I wrote a very basic python script to port scan my system. I'm running linux-mint lisa:

open_ports = []
for port in xrange(65536):
    conn = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        conn.connect(('localhost', port))
        open_ports.append(port)
        conn.close()
    except socket.error:
        pass

I returned a list of 7 ports and I ran netstat on each one:

sudo netstat -anlp | grep :(each port here)

I found that the first four were for cups, mysql, polipo, and tor but, the last three [44269, 46284, 47650] were much higher numbers and I didn't get anything back. I ran the script a few times more after this but, I would only return the first four.

Any ideas what they could be and what they're being used for?

share|improve this question
2  
Outbound traffic is normally sent with the higher ports. your port scan happened while tcp/udp sessions was in progress and ended before the sequential netstats –  llua Jan 15 '13 at 3:15
    
This is most likely the case. Thanks for clearing that up. Why not make a formal answer? –  tijko Jan 15 '13 at 3:27
    
wasn't sure if someone could give a even better answer. –  llua Jan 15 '13 at 15:13

1 Answer 1

up vote 3 down vote accepted

Outbound traffic is normally sent with the higher ports. Your port scan happened while a tcp/udp session was in progress and ended before the sequential netstats

share|improve this answer
1  
But outbound traffic would not have tripped his port scanner, since it is trying to connect to a listening port, not an outbound port. –  bonsaiviking Jan 16 '13 at 1:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.