Cannot identify process of listening port 600/tcp6

[Greg Veldman]

On Tue, Feb 19, 2019 at 11:53:24AM -0700, BBlister wrote:
> Yes you are right. If I kill rpc.lockd the two listening ports disappear. If
> I re-execute, then I can see two new unknown listening ports on other
> locations. For example, now I have  815/tcp4 and 874/tcp6 .
> 
> So I believe I should ask the freebsd-hackers which rpc.lockd cannot be
> listed on the sockstat or lsof (which means that this could be a way for a
> malicious process to do exactly what lockd does and open ports without being
> identified).

rpcinfo -p on the host should show you all running RPC services
and the port they're listening on.  It's another good thing to
check besides lsof/sockstat when looking for open ports.

-- 
Greg Veldman
freebsd at gregv.net