Port 993 is open but 'netstat' do not show it open.

tbyte

tbyte

It's FreeBSD 14.0-RELEASE-p3 #0: Mon Dec 11 04:56:01 UTC 2023
I can connect to the port

#:> telnet localhost 993
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Click to expand...
But it doesn't show in the netstat output.
netstat -ln | grep 993
Click to expand...
Could it have something to do with 'accf_data' module ?
 
List is too large, then it "misses" some information.

But judging by the 993 and 823 ports I would presume it's an IMAP server. Port 2049 is NFSv4.
 
SirDice said:
List is too large, then it "misses" some information.

But judging by the 993 and 823 ports I would presume it's an IMAP server. Port 2049 is NFSv4.
Click to expand...

I know what they are used for and that is the problem. Dovecot is not running and can not start because those ports are open ... by something. And I think '?' means the kernel itself.

cracauer@ said:
Try running sockstat as root?
Click to expand...
Why would you even presume it's not as root ?
 
tbyte said:
It's FreeBSD 14.0-RELEASE-p3 #0: Mon Dec 11 04:56:01 UTC 2023
I can connect to the port


But it doesn't show in the netstat output.

Could it have something to do with 'accf_data' module ?
Click to expand...
netstat -l does not show listening sockets. You need to use netstat -an | grep LISTEN. The -a option of netstat includes listening sockets, otherwise it doesn't.
 
SirDice said:
Some other service perhaps? Dovecot isn't the only possibility here.

Can you post the output of ps -aux?
Click to expand...
I have nothing else that uses 993 and after you connect to the port it it unresponsive:

Code: 
USER        PID  %CPU %MEM     VSZ     RSS TT  STAT STARTED       TIME COMMAND
tbyte     33896 146.9 39.8 4049316 2477368  2  I+   14:54    130:16.54 /usr/local/openjdk18/bin/java -Xmx2048M -Xms2048M -jar server.jar nogui
root         11  41.4  0.0       0      32  -  RNL  01:31   1570:56.95 [idle]
tbyte      1380   5.2  1.3  315564   83704  -  Ss   01:32    114:33.41 /usr/local/bin/transmission-daemon -c /fstore3/torrents/watch -g /fstore3/torrents/.config/transmission -w /fstore3/torrents/down
root         12   1.1  0.0       0     256  -  WL   01:31     74:33.44 [intr]
root          0   0.0  0.0       0    2224  -  DLs  01:31     22:44.94 [kernel]
root          1   0.0  0.0   11692     140  -  ILs  01:31      0:00.07 /sbin/init
root          2   0.0  0.0       0      32  -  WL   01:31      2:55.38 [clock]
root          3   0.0  0.0       0      48  -  DL   01:31      0:00.00 [crypto]
root          4   0.0  0.0       0      48  -  DL   01:31      2:08.62 [cam]
root          5   0.0  0.0       0      16  -  DL   01:31      0:00.00 [busdma]
root          6   0.0  0.0       0    1328  -  DL   01:31      1:38.66 [zfskern]
root          7   0.0  0.0       0      16  -  DL   01:31      0:07.87 [rand_harvestq]
root          8   0.0  0.0       0      48  -  DL   01:31      0:51.27 [pagedaemon]
root          9   0.0  0.0       0      16  -  DL   01:31      0:00.45 [vmdaemon]
root         10   0.0  0.0       0      16  -  DL   01:31      0:00.00 [audit]
root         13   0.0  0.0       0      48  -  DL   01:31      0:00.02 [geom]
root         14   0.0  0.0       0      16  -  DL   01:31      0:00.00 [sequencer 00]
root         15   0.0  0.0       0     160  -  DL   01:31      0:01.06 [usb]
root         16   0.0  0.0       0      16  -  DL   01:31      0:00.81 [acpi_thermal]
root         17   0.0  0.0       0     144  -  DL   01:31      0:10.70 [bufdaemon]
root         18   0.0  0.0       0      16  -  DL   01:31      0:00.57 [vnlru]
root         19   0.0  0.0       0      16  -  DL   01:31      0:09.14 [syncer]
root       1066   0.0  0.0   14408    1572  -  Is   01:32      0:00.04 /sbin/devd
root       1154   0.0  0.6   45912   34384  -  Ss   01:32      0:02.47 /usr/local/sbin/arpwatch -N -w tbyte -i bulsat0 -f /usr/local/arpwatch/arp.bulsat0.dat -P /var/run/arpwatch-bulsat0.pid
root       1156   0.0  0.5   45912   34116  -  Ss   01:32      0:02.07 /usr/local/sbin/arpwatch -N -w tbyte -i home0 -f /usr/local/arpwatch/arp.home0.dat -P /var/run/arpwatch-home0.pid
inadyn     1161   0.0  0.1   21320    5788  -  Ss   01:32      1:16.78 /usr/local/sbin/inadyn -p inadyn:inadyn -f /usr/local/etc/inadyn.conf -P /var/run/inadyn/inadyn.pid
root       1300   0.0  0.0   12868    1396  -  Ss   01:32      0:01.67 /usr/sbin/syslogd -n -a 10.0.0.1/24:* -b 10.0.0.1
bind       1326   0.0  0.6  110840   38168  -  Is   01:32      0:34.30 /usr/local/sbin/named -u bind -c /usr/local/etc/namedb/named.conf
root       1331   0.0  0.0   12792    1280  -  Ss   01:32      0:00.16 /usr/sbin/rpcbind
root       1338   0.0  0.0  274916    1088  -  Ss   01:32      0:00.07 /usr/sbin/rpc.statd
root       1344   0.0  0.0   12824    1036  -  Ss   01:32      0:00.14 /usr/sbin/rpc.lockd
dhcpd      1368   0.0  0.0   20644    2548  -  Ss   01:32      0:03.91 /usr/local/sbin/dhcpd -q -cf /usr/local/etc/dhcpd.conf -lf /var/db/dhcpd/dhcpd.leases -pf /var/run/dhcpd/dhcpd.pid -user dhcpd -g
ntpd       2335   0.0  0.0   23544    3020  -  Ss   01:32      0:04.70 /usr/sbin/ntpd -p /var/db/ntp/ntpd.pid -c /etc/ntp.conf -f /var/db/ntp/ntpd.drift -g
root       2338   0.0  0.0   12812    1116  -  Ss   01:32      0:01.63 /usr/sbin/powerd -a adp -n adp -m 95 -i 70 -p 1000
root       2357   0.0  0.1   19908    4892  -  Ss   01:32      0:02.32 /usr/local/sbin/openvpn --cd /usr/local/etc/openvpn --daemon openvpn --config /usr/local/etc/openvpn/openvpn.conf --writepid /var
root       2395   0.0  0.0   12852    1184  -  Ss   01:32      0:08.18 /usr/sbin/mountd -r /etc/exports /etc/zfs/exports
root       2406   0.0  0.0   12720    1036  -  Is   01:32      0:00.01 nfsd: master (nfsd)
root       2407   0.0  0.0   12720    1268  -  S    01:32      0:00.13 nfsd: server (nfsd)
rustdesk   2436   0.0  0.0   12820       4  -  IWs  -          0:00.00 daemon: /usr/local/bin/hbbr[2437] (daemon)
rustdesk   2437   0.0  0.0   32860    1664  -  I    01:32      0:04.72 /usr/local/bin/hbbr -k _
rustdesk   2447   0.0  0.0   12820       4  -  IWs  -          0:00.00 daemon: /usr/local/bin/hbbs[2448] (daemon)
rustdesk   2448   0.0  0.0   39524    2216  -  S    01:32      0:25.21 /usr/local/bin/hbbs -r 0.0.0.0 -k _
mysql      2456   0.0  0.0   13368       4  -  IWs  -          0:00.00 /bin/sh /usr/local/bin/mariadbd-safe --defaults-extra-file=/usr/local/etc/mysql/my.cnf --user=mysql --datadir=/var/db/mysql --pid
mysql      2672   0.0  0.1 1643904    7764  -  I    01:32      3:08.27 /usr/local/libexec/mariadbd --defaults-extra-file=/usr/local/etc/mysql/my.cnf --basedir=/usr/local --datadir=/var/db/mysql --plug
root       2689   0.0  0.0   12908     732  -  Is   01:32      0:00.24 /usr/sbin/cron -s
root       2795   0.0  0.0   12864    1020  -  IsJ  01:32      0:00.16 /usr/sbin/syslogd -ss
root       2838   0.0  0.0   12904     608  -  IsJ  01:32      0:00.27 /usr/sbin/cron -J 60 -s
root       2852   0.0  0.0   53352    2544  -  SsJ  01:32      0:02.61 /usr/local/sbin/httpd -DNOHTTPACCEPT
www        2884   0.0  0.0   53352       4  -  IWJ  -          0:00.00 /usr/local/sbin/httpd -DNOHTTPACCEPT
www        2885   0.0  0.0   53352       4  -  IWJ  -          0:00.00 /usr/local/sbin/httpd -DNOHTTPACCEPT
www        2886   0.0  0.0   53352       4  -  IWJ  -          0:00.00 /usr/local/sbin/httpd -DNOHTTPACCEPT
www        2887   0.0  0.0   53352       4  -  IWJ  -          0:00.00 /usr/local/sbin/httpd -DNOHTTPACCEPT
www        2888   0.0  0.0   53352       4  -  IWJ  -          0:00.00 /usr/local/sbin/httpd -DNOHTTPACCEPT
root       2975   0.0  0.0   12864    1008  -  IsJ  01:32      0:00.30 /usr/sbin/syslogd -ss
root       3917   0.0  0.0   12904     556  -  IsJ  01:32      0:00.18 /usr/sbin/cron -J 60 -s
mysql      3927   0.0  0.0   13364       4  -  IWsJ -          0:00.00 /bin/sh /usr/local/bin/mariadbd-safe --defaults-extra-file=/usr/local/etc/mysql/my.cnf --user=mysql --datadir=/var/db/mysql --pid
mysql      4075   0.0  1.0  794808   63648  -  IJ   01:32      1:18.29 /usr/local/libexec/mariadbd --defaults-extra-file=/usr/local/etc/mysql/my.cnf --basedir=/usr/local --datadir=/var/db/mysql --plug
root       4091   0.0  0.2  365104   12044  -  SsJ  01:32      0:03.09 /usr/local/sbin/httpd
www        4286   0.0  1.8  456368  111772  -  IJ   01:32      2:33.58 /usr/local/sbin/httpd
www        4287   0.0  0.7  456368   46328  -  IJ   01:32      2:00.16 /usr/local/sbin/httpd
www        4288   0.0  0.7  454320   44372  -  IJ   01:32      3:08.56 /usr/local/sbin/httpd
root       4595   0.0  0.0   12864    1028  -  IsJ  01:32      0:00.19 /usr/sbin/syslogd -ss
975        4642   0.0  0.0   12816       4  -  IWsJ -          0:00.00 daemon: /usr/local/openjdk17/bin/java[4643] (daemon)
975        4643   0.0  5.2 2934980  324160  -  IJ   01:32      8:19.01 /usr/local/openjdk17/bin/java -Djava.awt.headless=true -Xmx1024M --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.bas
root       4655   0.0  0.0   12904     532  -  IsJ  01:32      0:00.16 /usr/sbin/cron -J 60 -s
root       4667   0.0  0.0   12976    1300  -  Ss   01:32      0:00.22 /usr/sbin/inetd -wW -C 60
root       4682   0.0  0.0   12820       4  -  IWs  -          0:00.00 daemon: /usr/local/libexec/ts3server[4683] (daemon)
teamspeak  4683   0.0  0.1   95944    8112  -  I    01:32      4:54.10 /usr/local/libexec/ts3server dbsqlpath=/usr/local/share/teamspeak/server/sql/ inifile=/usr/local/etc/teamspeak/ts3server.ini lice
root       4700   0.0  0.1   22612    4176  -  Is   01:32      0:00.95 sshd: /usr/sbin/sshd [listener] 0 of 10-100 startups (sshd)
mailnull   4725   0.0  0.1   28176    6608  -  Is   01:33      0:21.03 /usr/local/sbin/exim -bd -q30m
root       4737   0.0  0.0   15344    1248  -  I    01:33      0:00.05 /usr/local/sbin/smartd -c /usr/local/etc/smartd.conf -p /var/run/smartd.pid
975        4749   0.0  0.8 1424172   50780  -  IJ   01:33      6:45.18 bin/mongod --dbpath /usr/local/share/java/unifi/data/db --port 27117 --unixSocketPrefix /usr/local/share/java/unifi/run --logRota
root       5015   0.0  0.1   22848    4588  -  Is   01:34      0:00.08 sshd: tbyte [priv] (sshd)
tbyte      5018   0.0  0.1   22848    4884  -  S    01:34      0:01.54 sshd: tbyte@pts/0 (sshd)
www        5023   0.0  1.8  456368  112456  -  SJ   01:34      2:36.95 /usr/local/sbin/httpd
www        5026   0.0  0.7  454320   45348  -  IJ   01:34      2:08.83 /usr/local/sbin/httpd
www        5029   0.0  0.7  456368   45676  -  IJ   01:34      3:04.04 /usr/local/sbin/httpd
www        5030   0.0  0.8  456368   46700  -  SJ   01:34      2:20.71 /usr/local/sbin/httpd
root       5053   0.0  0.0   14300    2040  -  Ss   01:35      0:00.99 screen (screen-4.9.1)
root       6014   0.0  0.0   13152    1476  -  Is   01:38      0:00.01 dhclient: system.syslog (dhclient)
root       6017   0.0  0.0   13152    1436  -  Is   01:38      0:00.02 dhclient: bulsat0 [priv] (dhclient)
_dhcp      6086   0.0  0.0   13156    1612  -  ICs  01:38      0:00.09 dhclient: bulsat0 (dhclient)
root       7707   0.0  0.1   62492    7716  -  Is   02:00      0:00.92 /usr/local/bin/smbnetfs /smbmnt
www       12788   0.0  1.1  454320   69456  -  IJ   03:47      1:34.72 /usr/local/sbin/httpd
www       22546   0.0  0.7  454320   45192  -  IJ   08:49      0:53.19 /usr/local/sbin/httpd
www       22547   0.0  0.7  456368   46060  -  IJ   08:49      1:04.00 /usr/local/sbin/httpd
root      36695   0.0  0.3   42180   21280  -  Ss   16:16      0:00.10 /usr/local/sbin/nmbd --daemon --configfile=/usr/local/etc/smb4.conf
root      36700   0.0  0.9  136700   53492  -  Is   16:16      0:01.96 /usr/local/sbin/smbd --daemon --configfile=/usr/local/etc/smb4.conf
root      36702   0.0  0.8  133864   50656  -  I    16:16      0:00.01 /usr/local/sbin/smbd --daemon --configfile=/usr/local/etc/smb4.conf
root      36703   0.0  0.8  134032   51280  -  S    16:16      0:00.02 /usr/local/sbin/smbd --daemon --configfile=/usr/local/etc/smb4.conf
root      37967   0.0  0.3   46360   19980  -  Ss   16:43      0:00.20 /usr/local/sbin/httpd
www       37968   0.0  0.3   46360   20456  -  I    16:43      0:00.25 /usr/local/sbin/httpd
www       37969   0.0  0.3   46360   20472  -  S    16:43      0:00.33 /usr/local/sbin/httpd
www       37970   0.0  0.3   46360   20460  -  I    16:43      0:00.24 /usr/local/sbin/httpd
www       37971   0.0  0.3   46360   20476  -  I    16:43      0:00.31 /usr/local/sbin/httpd
www       37972   0.0  0.3   46360   20468  -  I    16:43      0:00.27 /usr/local/sbin/httpd
www       37973   0.0  0.3   46360   20472  -  I    16:43      0:00.31 /usr/local/sbin/httpd
www       38025   0.0  0.3   46360   20468  -  I    16:43      0:00.24 /usr/local/sbin/httpd
www       38026   0.0  0.3   46360   20484  -  I    16:43      0:00.24 /usr/local/sbin/httpd
www       38027   0.0  0.3   46360   20464  -  I    16:43      0:00.31 /usr/local/sbin/httpd
root      39542   0.0  0.1   63068    8236  -  I    18:17      0:00.01 /usr/local/bin/smbnetfs /smbmnt
root       4739   0.0  0.0   12836    1072 v0  Is+  01:33      0:00.00 /usr/libexec/getty Pc ttyv0
root       4740   0.0  0.0   12836    1068 v1  Is+  01:33      0:00.00 /usr/libexec/getty Pc ttyv1
root       4741   0.0  0.0   12836    1072 v2  Is+  01:33      0:00.00 /usr/libexec/getty Pc ttyv2
root       4742   0.0  0.0   12836    1072 v3  Is+  01:33      0:00.00 /usr/libexec/getty Pc ttyv3
root       4743   0.0  0.0   12836    1072 v4  Is+  01:33      0:00.00 /usr/libexec/getty Pc ttyv4
root       4744   0.0  0.0   12836    1072 v5  Is+  01:33      0:00.00 /usr/libexec/getty Pc ttyv5
root       4745   0.0  0.0   12836    1072 v6  Is+  01:33      0:00.00 /usr/libexec/getty Pc ttyv6
root       4746   0.0  0.0   12836    1072 v7  Is+  01:33      0:00.00 /usr/libexec/getty Pc ttyv7
tbyte      5019   0.0  0.0   17332       4  0  IWs  -          0:00.00 -bash (bash)
tbyte      5052   0.0  0.0   14300     288  0  S+   01:35      0:00.18 screen (screen-4.9.1)
tbyte      5054   0.0  0.0   17332       4  1  IWs  -          0:00.00 -/usr/local/bin/bash
root       5056   0.0  0.0   13376       4  1  IW   -          0:00.00 su -
root       5057   0.0  0.1   17332    5152  1  S    01:35      0:00.57 -su (bash)
root      39806   0.0  0.0   13524    2896  1  R+   18:22      0:00.00 ps xau
tbyte     33891   0.0  0.0   17332       4  2  IWs  -          0:00.00 -/usr/local/bin/bash
tbyte     33895   0.0  0.0   17332       4  2  IW+  -          0:00.00 -/usr/local/bin/bash
 
As normal user lsof -i … won’t show any output. If it shows nothing even as root, while netstat -a shows someone is listening on that port, that would be strange….
 
bakul said:
As normal user lsof -i … won’t show any output. If it shows nothing even as root, while netstat -a shows someone is listening on that port, that would be strange….
Click to expand...
That's the whole point of this thread - it is strange. I'm using FreeBSD for 20 years and I have published kernel patches for it for the routing part so if it was something simple this thread would not exists 😁
 
tbyte said:
Code: 
root 4667 0.0 0.0 12976 1300 - Ss 01:32 0:00.22 /usr/sbin/inetd -wW -C 60
Click to expand...
Why is inetd(8) enabled? And did you perhaps configure it to listen on 993?

Code: 
mailnull   4725   0.0  0.1   28176    6608  -  Is   01:33      0:21.03 /usr/local/sbin/exim -bd -q30m
Double check its configuration too, perhaps you enabled 993 there.
 
Does “lsof -i 22” show anything? It should since sshd is listening on that port. If it doesn’t, may be a problem with lsof. More generally, “lsof -ni tcp” run as root should show you all connections as well as ports being listened to. See if you can account for them all.
 
bakul said:
Does “lsof -i 22” show anything? It should since sshd is listening on that port. If it doesn’t, may be a problem with lsof. More generally, “lsof -ni tcp” run as root should show you all connections as well as ports being listened to. See if you can account for them all.
Click to expand...
Of course it shows sshd. There is not problem with lsof itself.
#:> lsof -i :22
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 4700 root 3u IPv6 0xfffff80143ba3000 0 TCP *:ssh (LISTEN)
sshd 4700 root 4u IPv4 0xfffff8011c15f540 0 TCP *:ssh->*:* (LISTEN)
Click to expand...
SirDice said:
Why is inetd(8) enabled? And did you perhaps configure it to listen on 993?

Code: 
mailnull   4725   0.0  0.1   28176    6608  -  Is   01:33      0:21.03 /usr/local/sbin/exim -bd -q30m
Double check its configuration too, perhaps you enabled 993 there.
Click to expand...
The configurations of exim and dovecot have not changed for years.
Inetd(8)is local LAN ftpd only just double checked it - a leftover from the old days. I stopped it just in case but 993 is still open.
PS: Stopped exim too just in case - nothing changed.
 
Any idea if I can disable accf_data(9) on the fly ? I have a feeling it is the culprit. I can not unload it as it seems that it does not support unload.
 
SirDice said:
You should be able to unload it. But it might not want to if it's in use.
Click to expand...
#:> kldunload -f accf_data
kldunload: can't unload file: Operation not supported
Click to expand...
-f should force it even if it is in use.
Still I checked it just to be sure and it really does not support unload events:

C: 
accept_filt_generic_mod_event(module_t mod, int event, void *data)
{
        struct accept_filter *p;
        struct accept_filter *accfp = (struct accept_filter *) data;
        int error;

        switch (event) {
        case MOD_LOAD:
                p = malloc(sizeof(*p), M_ACCF,
                    M_WAITOK);
                bcopy(accfp, p, sizeof(*p));
                error = accept_filt_add(p);
                break;

        case MOD_UNLOAD:
                /*
                 * Do not support unloading yet. we don't keep track of
                 * refcounts and unloading an accept filter callback and then
                 * having it called is a bad thing.  A simple fix would be to
                 * track the refcount in the struct accept_filter.
                 */
                if (unloadable != 0) {
                        error = accept_filt_del(accfp->accf_name);
                } else
                        error = EOPNOTSUPP;
                break;

        case MOD_SHUTDOWN:
                error = 0;
                break;

        default:
                error = EOPNOTSUPP;
                break;
        }

        return (error);
}
 
Using this I was able to unload it. But I'm not sure it's a clean unload as the port is still open and the whole operation is not recommended. So I guess it's not cleaning up before it unloads itself.
net.accf.unloadable: Allow unload of accept filters (not recommended)
Click to expand...
If this is not the culprit then I'm at a total loss.
 
Only a reboot fixed it. And I removed the accept filters. There is something wrong with them or at least the "data" one. If I have more time I'll try to look into it.
 
You must log in or register to reply here.
Back
Top