Tcp Port Open by Unknown Service

Question

Running openSUSE 11.2 x86_64.

Here's what a nmap of my IP provides:

PORT STATE SERVICE
23/tcp open telnet
80/tcp open http
2800/tcp open unknown
8008/tcp open http

I would like to know how to view what service is causing port 2800 to be opened?

A few search engine results led me to believe that it is supposedly a port opened by a Trojan called "Theef".

If it is indeed a Trojan, what can be done to weed it out? Is my desktop's security compromised?

Solution 1

what do you see after running (as root):

nmap -sV --version-intensity 9 -p 2800 localhost

What makes you think you have a trojan? What have you been doing lately? And why are you running telnet?

Solution 2

The -p switch to netstat should show you what processes have what ports open:

sudo netstat -p

Solution 3

lsof can help also:

sudo lsof -i TCP:2800

Comments

[meh]

Tried that command, Port 80 returns results. Ports 23,2800,8008 refuse to do so. No results appear. Also tried fuser -nu tcp 2800, fuser 2800/tcp they also do not return anything.

[Sorceri]

-sV is for identifying V-ersion numbers of any services or daemons running on the host(s). It shouldn't actually close any already open ports. Maybe something else happened....

[Sorceri]

I didn't know one could do that with lsof and fuser.