2

I conducted a basic nmap scan of a box I have set up below is the output. 

$ nmap xxx.xx.org

Starting Nmap 7.40SVN ( https://nmap.org ) at 2017-05-17 13:25 GMT
Nmap scan report for xxx.xx.xx (xx.xx.5.180)
Host is up (0.00069s latency).
rDNS record for xx.xx.5.180: www.xxx.org
Not shown: 988 filtered ports
PORT      STATE  SERVICE
20/tcp    closed ftp-data
21/tcp    open   ftp
53/tcp    open   domain
80/tcp    open   http
110/tcp   open   pop3
143/tcp   open   imap
443/tcp   open   https
993/tcp   open   imaps
995/tcp   open   pop3s
1123/tcp  open   murray
2030/tcp  open   device2
10000/tcp open   snet-sensor-mgmt

Nmap done: 1 IP address (1 host up) scanned in 4.94 seconds

what cought my interest was murray port, I dont seem to find what is that making that port open.

Ismail Yushaw
  • 131
  • 1
  • 4

2 Answers2

4

That's me! I'm the author of murray. It was a webshots-like system, for windows and os/2 and I registered port 1123 for it. Alas, you're probably not running murray, so it's some other program that just happens to be using that port.

sudo netstat -napt | grep 1123

and that will tell you what process is actually holding that port, and that might give you a clue as to what's really using it.

stu
  • 8,461
  • 18
  • 74
  • 112
1

The "murray" name comes from the nmap-services database of well-known port numbers and service names. It does not necessarily indicate what software is really using that port. For that, you need to either use Nmap's service and application version detection (-sV) or use the netstat command on the target system directly to list the process that is using port 1123.

bonsaiviking
  • 5,825
  • 1
  • 20
  • 35