15:28:29.927590 execve("/usr/sbin/rpc.mountd", ["rpc.mountd"], [/* 36 vars */]) = 0 15:28:29.928761 brk(0) = 0x663000 15:28:29.929019 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 15:28:29.929192 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a606000 15:28:29.929362 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) 15:28:29.929495 open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3 15:28:29.929622 fstat(3, {st_mode=S_IFREG|0644, st_size=29633, ...}) = 0 15:28:29.929738 mmap(NULL, 29633, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f363a5fe000 15:28:29.929845 close(3) = 0 15:28:29.929952 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 15:28:29.930070 open("/lib/x86_64-linux-gnu/libwrap.so.0", O_RDONLY|O_CLOEXEC) = 3 15:28:29.930192 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p-\0\0\0\0\0\0@\0\0\0\0\0\0\0\230\210\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|}\0\0\0\0\0\0|}\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\200}\0\0\0\0\0\0\200} \0\0\0\0\0\200} \0\0\0\0\0\24\n\0\0\0\0\0\0 \23\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\230}\0\0\0\0\0\0\230} \0\0\0\0\0\230} \0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0Lo\0\0\0\0\0\0Lo\0\0\0\0\0\0Lo\0\0\0\0\0\0\374\1\0\0\0\0\0\0\374\1\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0\200}\0\0\0\0\0\0\200} \0\0\0\0\0\200} \0\0\0\0\0\200\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0T\374\274[\17\231J\23\251\260\352\324o#\347\332\177\177\347[\0\0\0\0%\0\0\0^\0\0\0\4\0\0\0\10\0\0\0\"\24\10\0\202\2\4\0(\3305\20\242(\202\1\314\340\1\352\r\10\21+\f2Z\223\20\265O\0\0\0\0\0^\0\0\0\0\0\0\0_\0\0\0a\0\0\0d\0\0\0f\0\0\0h\0\0\0\0\0\0\0\0\0\0\0m\0\0\0\0\0\0\0n\0\0\0\0\0\0\0o\0\0\0p\0\0\0\0\0\0\0s\0\0\0t\0\0\0u\0\0\0w\0\0\0x\0\0\0y\0\0\0{\0\0\0|\0\0\0}\0\0\0\0\0\0\0\0\0\0\0\200\0\0\0\201\0\0\0\203\0\0\0\205\0\0\0\206\0\0\0\210\0\0\0\0\0\0\0\211\0\0\0\212\0\0\0\233 \363\356\326\231Y4\23\362\225;\252\237D\373j\270q\264\rAY9\352\323\357\16\351\21/(T\314&\333\303\355\243#\314\334\216;\314_\326Z\220\7A\243\356\266(\31S\34\336{\261\264\264\20\271NF\277\203Y8S\216F)\240\362\tW\24\361\224\225\25O\234\22\312e\355ZNTN\203:\237\203\272+\303\262FT\203\315J\331 \251\225R\253\275\246\265\271B\214`\331qX\34`\317\n\250p\322A\373\273\343\222|\355d\315\344", 832) = 832 15:28:29.930335 fstat(3, {st_mode=S_IFREG|0644, st_size=36632, ...}) = 0 15:28:29.930447 mmap(NULL, 2134176, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f363a1dc000 15:28:29.930554 mprotect(0x7f363a1e4000, 2093056, PROT_NONE) = 0 15:28:29.930703 mmap(0x7f363a3e3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7000) = 0x7f363a3e3000 15:28:29.930844 mmap(0x7f363a3e5000, 160, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f363a3e5000 15:28:29.931005 close(3) = 0 15:28:29.931129 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 15:28:29.931246 open("/lib/x86_64-linux-gnu/libblkid.so.1", O_RDONLY|O_CLOEXEC) = 3 15:28:29.931363 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320^\0\0\0\0\0\0@\0\0\0\0\0\0\0\370W\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\354\37\2\0\0\0\0\0\354\37\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0X)\2\0\0\0\0\0X)\"\0\0\0\0\0X)\"\0\0\0\0\0\200-\0\0\0\0\0\0\260-\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\300M\2\0\0\0\0\0\300M\"\0\0\0\0\0\300M\"\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\310\315\1\0\0\0\0\0\310\315\1\0\0\0\0\0\310\315\1\0\0\0\0\0\34\v\0\0\0\0\0\0\34\v\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0X)\2\0\0\0\0\0X)\"\0\0\0\0\0X)\"\0\0\0\0\0\250&\0\0\0\0\0\0\250&\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\375\30\35\17$:(!\360\342%\230r\371\n\236i\321\373J\0\0\0\0a\0\0\0h\0\0\0\20\0\0\0\n\0\0\0\210\"\0\200\1\0f\0\22 \4\244\20\0 \n\10\215\322`\242\4!\10\240\312\240\203\10\6\202\1\1\2\6`\234\10\0\20\0\n\20\223\0104\302+\0\0\0\0@\204(P\200\20A\10\0\1\0\t\0\n\2\20\0\0\0\0\23\2\21\0\10\0\n\7\4b,\5\32\10C\222\10\0\r\0\300\24\0\2\200\4!@\240\0\220\0\0\10\2\0\0\202\20\200\10\1\0\20$\0\4\10\4\242`\10\321\202(\0h\0\0\0\0\0\0\0i\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0j\0\0\0\0\0\0\0l\0\0\0m\0\0\0n\0\0\0o\0\0\0\0\0\0\0r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0s\0\0\0\0\0\0\0t\0\0\0u\0\0\0\0\0\0\0v\0\0\0w\0\0\0x\0\0\0y\0\0\0z\0\0\0{\0\0\0}\0\0\0\200\0\0\0\203\0\0\0\204\0\0\0\205\0\0\0\207\0\0\0\210\0\0\0\212\0\0\0\0\0\0\0\213\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\216\0\0\0\217\0\0\0\0\0\0\0\0\0\0\0\221\0\0\0\225\0\0\0\0\0\0\0", 832) = 832 15:28:29.931522 fstat(3, {st_mode=S_IFREG|0644, st_size=155384, ...}) = 0 15:28:29.931822 mmap(NULL, 2250504, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f3639fb6000 15:28:29.931931 mprotect(0x7f3639fd8000, 2097152, PROT_NONE) = 0 15:28:29.932044 mmap(0x7f363a1d8000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x22000) = 0x7f363a1d8000 15:28:29.932187 close(3) = 0 15:28:29.932305 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 15:28:29.932421 open("/lib/x86_64-linux-gnu/libtirpc.so.1", O_RDONLY|O_CLOEXEC) = 3 15:28:29.932539 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0q\0\0\0\0\0\0@\0\0\0\0\0\0\0HV\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0TB\2\0\0\0\0\0TB\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\0H\2\0\0\0\0\0\0H\"\0\0\0\0\0\0H\"\0\0\0\0\0\30\r\0\0\0\0\0\0\230\30\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220L\2\0\0\0\0\0\220L\"\0\0\0\0\0\220L\"\0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\350\350\1\0\0\0\0\0\350\350\1\0\0\0\0\0\350\350\1\0\0\0\0\0\314\v\0\0\0\0\0\0\314\v\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0\0H\2\0\0\0\0\0\0H\"\0\0\0\0\0\0H\"\0\0\0\0\0\0\10\0\0\0\0\0\0\0\10\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0e\307R\n\2568*\177$\263\312nNu\331\265\371\227\370.\0\0\0\0\7\1\0\0\214\0\0\0 \0\0\0\v\0\0\0 #\0C\0^\243\244@\200\274\n\200\0Z\212L\10@\247\242\20!\340\210 \4\244\f\247G\2\20\0\200\300B\0,\34`L\220u \200\24 \0\201\1\0\0 \r\0Q\300\1\0 \26\240\10Y\24ip\200B\vH\221\20D\0\t\30\341\306 \0\3B@\22\2$A\1B\314\7Q\2\300 4\200\4H\0\22pA\10A\10\201\0\4\4\nH\30\10\4\204\30\24\360!\300\0235H\204\1JP\0\363\tR1\16@\3204C\344\210\24\f\0\0\f\340@,\0\1\0@\24\203\7\252\7\204)\302\20\5@\0\tx$B\201\24\t\200 \213\2C\304\210!\6\261\242\5\321\0\10@\4\200\226\220 \2\16\213#\\\0028\t\0\210(\240\3%P!\0\34` \315\221\t((P\204\10\1(@F@\0`bH2(C\220\20\20\26\n\0\0\10 \10\20J\25 \230 \10\2\267\0\26\214\0\0\0\0\0\0\0\216\0\0\0\217\0\0\0\0\0\0\0\222\0\0\0\0\0\0\0\224\0\0\0\225\0\0\0\226\0\0\0\0\0\0\0\230\0\0\0\231\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 832) = 832 15:28:29.932669 fstat(3, {st_mode=S_IFREG|0644, st_size=154888, ...}) = 0 15:28:29.932779 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a5fd000 15:28:29.932894 mmap(NULL, 2252952, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f3639d8f000 15:28:29.932999 mprotect(0x7f3639db4000, 2093056, PROT_NONE) = 0 15:28:29.933108 mmap(0x7f3639fb3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x24000) = 0x7f3639fb3000 15:28:29.933229 mmap(0x7f3639fb5000, 152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f3639fb5000 15:28:29.933371 close(3) = 0 15:28:29.933488 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 15:28:29.933602 open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 15:28:29.933718 read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\37\2\0\0\0\0\0@\0\0\0\0\0\0\0@\"\34\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0F\0E\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300\217\30\0\0\0\0\0\300\217\30\0\0\0\0\0\300\217\30\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\261\33\0\0\0\0\0\324\261\33\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0@\267\33\0\0\0\0\0@\267;\0\0\0\0\0@\267;\0\0\0\0\0`Q\0\0\0\0\0\0`\233\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\353\33\0\0\0\0\0\240\353;\0\0\0\0\0\240\353;\0\0\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0p\2\0\0\0\0\0\0p\2\0\0\0\0\0\0p\2\0\0\0\0\0\0D\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\7\0\0\0\4\0\0\0@\267\33\0\0\0\0\0@\267;\0\0\0\0\0@\267;\0\0\0\0\0\20\0\0\0\0\0\0\0\260\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0P\345td\4\0\0\0\334\217\30\0\0\0\0\0\334\217\30\0\0\0\0\0\334\217\30\0\0\0\0\0,g\0\0\0\0\0\0,g\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0@\267\33\0\0\0\0\0@\267;\0\0\0\0\0@\267;\0\0\0\0\0\3008\0\0\0\0\0\0\3008\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0H\250+y\23\32\337\242<\340\306\21\226\253\305\237\227\311yM\4\0\0\0\20\0\0\0\1\0\0\0GNU\0\0\0\0\0\2\0\0\0\6\0\0\0\30\0\0\0\0\0\0\0\363\3\0\0\n\0\0\0\0\1\0\0\16\0\0\0\0000\20D\240 \2\1\210\3\346\220\305E\214\0\300\0\10\0\5\200\0`\300\200\0\r\212\f\0\4\20\0\210D2\10.@\210P4, \16\"H&\204\300\214\4\10\0\2\2\16\241\254\32\4f\300\0\3002\0\300\0P\1 \201\10\204\v ($\0\4 P\0\20X\200\312DB(\0\6\200\20\30B\0 @\200\0\tP\0Q\212@\20\0\0\0\0\10\0\0\21\20", 832) = 832 15:28:29.933849 fstat(3, {st_mode=S_IFREG|0755, st_size=1848256, ...}) = 0 15:28:29.933960 mmap(NULL, 3953312, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f36399c9000 15:28:29.934068 mprotect(0x7f3639b85000, 2093056, PROT_NONE) = 0 15:28:29.934180 mmap(0x7f3639d84000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1bb000) = 0x7f3639d84000 15:28:29.934305 mmap(0x7f3639d8a000, 17056, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f3639d8a000 15:28:29.934432 close(3) = 0 15:28:29.934555 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 15:28:29.934669 open("/lib/x86_64-linux-gnu/libnsl.so.1", O_RDONLY|O_CLOEXEC) = 3 15:28:29.934785 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`A\0\0\0\0\0\0@\0\0\0\0\0\0\0\220t\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\36\0\35\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\300,\1\0\0\0\0\0\300,\1\0\0\0\0\0\300,\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210a\1\0\0\0\0\0\210a\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0Xm\1\0\0\0\0\0Xm!\0\0\0\0\0Xm!\0\0\0\0\0\20\6\0\0\0\0\0\0\200-\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0pm\1\0\0\0\0\0pm!\0\0\0\0\0pm!\0\0\0\0\0\20\2\0\0\0\0\0\0\20\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0008\2\0\0\0\0\0\0008\2\0\0\0\0\0\0008\2\0\0\0\0\0\0D\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\334,\1\0\0\0\0\0\334,\1\0\0\0\0\0\334,\1\0\0\0\0\0\\\5\0\0\0\0\0\0\\\5\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0Xm\1\0\0\0\0\0Xm!\0\0\0\0\0Xm!\0\0\0\0\0\250\2\0\0\0\0\0\0\250\2\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\215\264i\234\23`\7\333\215\242\205\210Bt\272c\302Py\266\4\0\0\0\20\0\0\0\1\0\0\0GNU\0\0\0\0\0\2\0\0\0\6\0\0\0\30\0\0\0\0\0\0\0\370\0\0\0s\0\0\0\20\0\0\0\n\0\0\0\1\0015\232 '@\0@\0\0\2\f!\1\10\0:\0\0\241\nX\0H\0\16,\0\5\200\6`\260\23 @\224\21\20@\344r\224D\350\206@1\250\202@\260z\1=\10\331\0\0\20\26\200\0044B\201*\0209\203K\200\20 \"\221\3\0D\200\302*d`E\10\0\4\4\t\4PDB\200\20\300\22!\4`@\0\32 \0\0\0\10\4\2\200\220\200\0\344#\0\212$\2\206\210\0\0`\300\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0s\0\0\0t\0\0\0\0\0\0\0\0\0\0\0u\0\0\0w\0\0\0x\0\0\0y\0\0\0", 832) = 832 15:28:29.934928 fstat(3, {st_mode=S_IFREG|0644, st_size=97296, ...}) = 0 15:28:29.935091 mmap(NULL, 2202328, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f36397af000 15:28:29.935200 mprotect(0x7f36397c6000, 2093056, PROT_NONE) = 0 15:28:29.935312 mmap(0x7f36399c5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x16000) = 0x7f36399c5000 15:28:29.935442 mmap(0x7f36399c7000, 6872, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f36399c7000 15:28:29.935566 close(3) = 0 15:28:29.935685 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 15:28:29.935798 open("/lib/x86_64-linux-gnu/libuuid.so.1", O_RDONLY|O_CLOEXEC) = 3 15:28:29.935914 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\26\0\0\0\0\0\0@\0\0\0\0\0\0\0\270B\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\35\0\34\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00044\0\0\0\0\0\00044\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\250=\0\0\0\0\0\0\250= \0\0\0\0\0\250= \0\0\0\0\0\360\3\0\0\0\0\0\0\10\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\310=\0\0\0\0\0\0\310= \0\0\0\0\0\310= \0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\7\0\0\0\4\0\0\0\250=\0\0\0\0\0\0\250= \0\0\0\0\0\250= \0\0\0\0\0\4\0\0\0\0\0\0\0N\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0P\345td\4\0\0\0h.\0\0\0\0\0\0h.\0\0\0\0\0\0h.\0\0\0\0\0\0\344\0\0\0\0\0\0\0\344\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0\250=\0\0\0\0\0\0\250= \0\0\0\0\0\250= \0\0\0\0\0X\2\0\0\0\0\0\0X\2\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0:>\267<\341\361\30\344f\254}\306\220]ZS:\243v\345\0\0\0\0\21\0\0\0004\0\0\0\2\0\0\0\7\0\0\0TL\317$\4\n\0\2E\10\25$\22\4Q\0024\0\0\0006\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0007\0\0\0008\0\0\0:\0\0\0=\0\0\0\0\0\0\0>\0\0\0?\0\0\0@\0\0\0A\0\0\0D\0\0\0E\0\0\0F\0\0\0\234)\27\252\207k\345[\21\210t&q\201\201\346\212+\361+]\n\362\253\242e\370(d\210\352\246a\0\246\207\205KI\210\353\305\361\253\271\t\262\267\365\334tp\32\3\345\222R*1\33\227\325\335)\203\224@P\23\347\0Hv\215\350\253G@+\t\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\n\0P\23\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\21\0\250= \0\0\0\0\0\0\0\0\0\0\0\0\0\357\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 832) = 832 15:28:29.936043 fstat(3, {st_mode=S_IFREG|0644, st_size=18936, ...}) = 0 15:28:29.936151 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a5fc000 15:28:29.936269 mmap(NULL, 2113968, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f36395aa000 15:28:29.936377 mprotect(0x7f36395ae000, 2093056, PROT_NONE) = 0 15:28:29.936488 mmap(0x7f36397ad000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7f36397ad000 15:28:29.936623 close(3) = 0 15:28:29.936738 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 15:28:29.936851 open("/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2", O_RDONLY|O_CLOEXEC) = 3 15:28:29.936968 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\256\0\0\0\0\0\0@\0\0\0\0\0\0\0\30`\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3541\4\0\0\0\0\0\3541\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\200<\4\0\0\0\0\0\200<$\0\0\0\0\0\200<$\0\0\0\0\0x\"\0\0\0\0\0\0\300$\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0HL\4\0\0\0\0\0HL$\0\0\0\0\0HL$\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0<\254\3\0\0\0\0\0<\254\3\0\0\0\0\0<\254\3\0\0\0\0\0|\16\0\0\0\0\0\0|\16\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0\200<\4\0\0\0\0\0\200<$\0\0\0\0\0\200<$\0\0\0\0\0\200\23\0\0\0\0\0\0\200\23\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\230O\1yv\245\241\237\344\34\320\301B\24\7\33#\16\330(\0\0\0\0\203\0\0\0\23\1\0\0\20\0\0\0\n\0\0\0\244\0\227I\30\30\0 f\204\300\0\6P \16\4\0\240\2 P\200!\2424\240q\2603D \202\204\31A \7\1\10\230\t \7\244`@\306\22@\300\1\1\n\"\206`\10\360\0\22\26h\240\202\230\210\0J\0\240\10\30\206\220\1\2M:\"\2\324\200H\254\30P\0040\241\1\242\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\1\0\0C\1\0\0D\1\0\0F\1\0\0", 832) = 832 15:28:29.937110 fstat(3, {st_mode=S_IFREG|0644, st_size=288536, ...}) = 0 15:28:29.937220 mmap(NULL, 2384192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f3639363000 15:28:29.937327 mprotect(0x7f36393a7000, 2093056, PROT_NONE) = 0 15:28:29.937439 mmap(0x7f36395a6000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x43000) = 0x7f36395a6000 15:28:29.937563 mmap(0x7f36395a9000, 320, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f36395a9000 15:28:29.937689 close(3) = 0 15:28:29.937808 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 15:28:29.937920 open("/lib/x86_64-linux-gnu/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3 15:28:29.938035 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340o\0\0\0\0\0\0@\0\0\0\0\0\0\0h\243\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0'\0$\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\220.\1\0\0\0\0\0\220.\1\0\0\0\0\0\220.\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\1\0\0\0\0\0\0\210\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\200\213\1\0\0\0\0\0\200\213!\0\0\0\0\0\200\213!\0\0\0\0\0p\7\0\0\0\0\0\0\260I\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0P\215\1\0\0\0\0\0P\215!\0\0\0\0\0P\215!\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0008\2\0\0\0\0\0\0008\2\0\0\0\0\0\0008\2\0\0\0\0\0\0D\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\254.\1\0\0\0\0\0\254.\1\0\0\0\0\0\254.\1\0\0\0\0\0\354\n\0\0\0\0\0\0\354\n\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0\200\213\1\0\0\0\0\0\200\213!\0\0\0\0\0\200\213!\0\0\0\0\0\200\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\330\341\376y\27\7\274\243\234\273\25\340\367\223\233\300\343X\25\37\4\0\0\0\20\0\0\0\1\0\0\0GNU\0\0\0\0\0\2\0\0\0\6\0\0\0\30\0\0\0\0\0\0\0\345\1\0\0W\0\0\0 \0\0\0\v\0\0\0\31#\2\261\1\10\20\2@@a\370\3\10\10\25\200 \0\0\0\0\200\300\321Q\0\0\0\22\353\3020D\0\10\20A\0\2\0\2\f\1\200\v\221\1\330\240\r\240@\230 \244\200\21\n\202-l@g\214V\24\0\224 \200$H\200P(\1\22\f\311B\240\220\22\10\f \2ZdA\245c\4@\n\n\n\0\2009\1(\314@\204\201@\22\10(\fD\0\0\0\200Q\10\200\35\4B\320\2608A\0\1\0\0\265\0300\0\200`\2\20\"\0\tA\20\1\5\0P(\251\22G(\0\0\202\4\230@\4\0\20\340T\0\2@\2\2\20\3010D\26\200\0", 832) = 832 15:28:29.938165 fstat(3, {st_mode=S_IFREG|0755, st_size=145472, ...}) = 0 15:28:29.938275 mmap(NULL, 2217264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f3639145000 15:28:29.938382 mprotect(0x7f363915e000, 2093056, PROT_NONE) = 0 15:28:29.938511 mmap(0x7f363935d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x18000) = 0x7f363935d000 15:28:29.938635 mmap(0x7f363935f000, 13616, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f363935f000 15:28:29.938759 close(3) = 0 15:28:29.938884 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 15:28:29.939025 open("/usr/lib/x86_64-linux-gnu/libkrb5.so.3", O_RDONLY|O_CLOEXEC) = 3 15:28:29.939139 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\4\2\0\0\0\0\0@\0\0\0\0\0\0\0\300\272\f\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\\305\v\0\0\0\0\0\\\305\v\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\330\320\v\0\0\0\0\0\330\320+\0\0\0\0\0\330\320+\0\0\0\0\0\320\350\0\0\0\0\0\0\350\353\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\234\f\0\0\0\0\0\240\234,\0\0\0\0\0\240\234,\0\0\0\0\0@\2\0\0\0\0\0\0@\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\200c\n\0\0\0\0\0\200c\n\0\0\0\0\0\200c\n\0\0\0\0\0\2540\0\0\0\0\0\0\2540\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0\330\320\v\0\0\0\0\0\330\320+\0\0\0\0\0\330\320+\0\0\0\0\0(\317\0\0\0\0\0\0(\317\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0YL\2420\245*\352\216\337%\355\263eiY\3:\3527X\0\0\0\0\t\2\0\0\377\0\0\0@\0\0\0\f\0\0\0\342\1\220\20\0\300\321EHB\0\20\243\23Hp\201\0\223\205\1\5\270f!Z\316\30\324%\\\220\240\200\2B\24\3(\4L\230\202 \204XI\211\2\f\0\240\200\0IBC\201\4\10\200(\5\215\10\0C\200\10\2\0!D\200\210C\0\212\1\22=J2D\200\25\201\0+\344\4\326\220\20\0\224\t1\326\320\0@\203\263'\6\260y\210\340\30\242\20\t\1\340\20\2#\24c\n\207\4\0\0103\201\1\20\4\5\0\20\21\0\0\341 R\20\202\0\34 db\3`\21 `\0011\27!\221\f\231\10\211D12\0049nR@\0\16@\204\240\0D\4H`\10-j@0f\262\200 \0\0`\222\200\0\342Q\10GSp\240D\20\240\1@E\20\20\242\361u\235\230=\272\201\241\200\f\4\310\0\1B\0BHP\0\2\200\21$\4@:\32\0\4\34\22\202\0`\314\6\2620D\205\0\222FA\0`p\3\251\204P\266%$\20(\245\214B\fp\0009\10\4\0\0@\16\320#\2204\26\2024*@\0\202\2\31\0\30\224\2\370B\20\4\200\303\270\204\25EMp\6\204$\6\10\2\24\300R\1\n", 832) = 832 15:28:29.939266 fstat(3, {st_mode=S_IFREG|0644, st_size=836032, ...}) = 0 15:28:29.939375 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a5fb000 15:28:29.939489 mmap(NULL, 2931904, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f3638e79000 15:28:29.941529 mprotect(0x7f3638f36000, 2097152, PROT_NONE) = 0 15:28:29.941650 mmap(0x7f3639136000, 61440, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xbd000) = 0x7f3639136000 15:28:29.941801 close(3) = 0 15:28:29.941936 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 15:28:29.942056 open("/usr/lib/x86_64-linux-gnu/libk5crypto.so.3", O_RDONLY|O_CLOEXEC) = 3 15:28:29.942551 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@@\0\0\0\0\0\0@\0\0\0\0\0\0\0\310\322\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\364\274\2\0\0\0\0\0\364\274\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\10\276\2\0\0\0\0\0\10\276\"\0\0\0\0\0\10\276\"\0\0\0\0\0\240\23\0\0\0\0\0\0\320\"\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\230\315\2\0\0\0\0\0\230\315\"\0\0\0\0\0\230\315\"\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\334\200\2\0\0\0\0\0\334\200\2\0\0\0\0\0\334\200\2\0\0\0\0\0\224\7\0\0\0\0\0\0\224\7\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0\10\276\2\0\0\0\0\0\10\276\"\0\0\0\0\0\10\276\"\0\0\0\0\0\370\21\0\0\0\0\0\0\370\21\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\341\347O!\23\312\212\30\225\302p\6Ft\241\365&\362!\327\0\0\0\0a\0\0\0000\0\0\0\20\0\0\0\n\0\0\0005\4 \0\1X\22\1 \25i\0\1@\6\322\222\317\0@\202\0B8\204D$\343*S\0\220\2\4\200\20\n\215\1\0\1\200\0\2\0\0000\201\200\0\0\5\2\2@\210\24$\1\201\0\0\0\200H\n$@\f\20Q\0\2\"(\240\"\32\206\20 \v\2\20\21\200\204\305\0Rb\22\"\222\10\5@\0B `\25\0\211\201A\0\4\0@$\0\200`\1\2\0\0\10\10@\0BD\0\0\10\0170\0\0\0002\0\0\0004\0\0\0005\0\0\0\0\0\0\0006\0\0\0009\0\0\0:\0\0\0\0\0\0\0=\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0>\0\0\0\0\0\0\0?\0\0\0A\0\0\0B\0\0\0F\0\0\0G\0\0\0H\0\0\0J\0\0\0L\0\0\0M\0\0\0N\0\0\0O\0\0\0Q\0\0\0R\0\0\0T\0\0\0U\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0W\0\0\0\0\0\0\0X\0\0\0Z\0\0\0[\0\0\0\0\0\0\0\0\0\0\0\\\0\0\0]\0\0\0_\0\0\0`\0\0\0\0\0\0\0a\0\0\0c\0\0\0\0\0\0\0", 832) = 832 15:28:29.942807 fstat(3, {st_mode=S_IFREG|0644, st_size=186824, ...}) = 0 15:28:29.942997 mmap(NULL, 2285784, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f3638c4a000 15:28:29.943129 mprotect(0x7f3638c76000, 2093056, PROT_NONE) = 0 15:28:29.943245 mmap(0x7f3638e75000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2b000) = 0x7f3638e75000 15:28:29.943393 mmap(0x7f3638e78000, 216, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f3638e78000 15:28:29.943525 close(3) = 0 15:28:29.943656 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 15:28:29.943791 open("/lib/x86_64-linux-gnu/libcom_err.so.2", O_RDONLY|O_CLOEXEC) = 3 15:28:29.943922 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\200\24\0\0\0\0\0\0@\0\0\0\0\0\0\0@2\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0\33\0\32\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\24%\0\0\0\0\0\0\24%\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\214-\0\0\0\0\0\0\214- \0\0\0\0\0\214- \0\0\0\0\0\254\3\0\0\0\0\0\0<\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\270-\0\0\0\0\0\0\270- \0\0\0\0\0\270- \0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\7\0\0\0\4\0\0\0\214-\0\0\0\0\0\0\214- \0\0\0\0\0\214- \0\0\0\0\0\0\0\0\0\0\0\0\0\31\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0P\345td\4\0\0\0\4!\0\0\0\0\0\0\4!\0\0\0\0\0\0\4!\0\0\0\0\0\0\274\0\0\0\0\0\0\0\274\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0\214-\0\0\0\0\0\0\214- \0\0\0\0\0\214- \0\0\0\0\0t\2\0\0\0\0\0\0t\2\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0j\265\ve\201\200\377\376J\277y\337y\354\263\344K\231\r\334\0\0\0\0\21\0\0\0)\0\0\0\4\0\0\0\10\0\0\0\23\1\20H@\2\0\360(\2\0\1\10\0\200\202\0020\0\20\10\0d\251\246\4\10\t\0\4\na)\0\0\0,\0\0\0.\0\0\0000\0\0\0003\0\0\0004\0\0\0005\0\0\0006\0\0\0009\0\0\0\0\0\0\0\0\0\0\0<\0\0\0=\0\0\0?\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\23452\36\0\324\272\243\333=\370T\352\323\357\16\5\246\25\205X\311e\234\271\215\361\16\266\301k0\330qX\34\303E\205d\273\343\222|?\210l\257\301\2767\33b?,\5BE\325\354)\251\261>\0\177\10L<[\346\232wy\235\23\307\n|4\262\177\"\310\37=)\313\363A\26\364\214\375[\323\371\361\345>\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\t\0000\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\20\0\214- \0\0\0\0\0", 832) = 832 15:28:29.944055 fstat(3, {st_mode=S_IFREG|0644, st_size=14592, ...}) = 0 15:28:29.944163 mmap(NULL, 2109896, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f3638a46000 15:28:29.944269 mprotect(0x7f3638a49000, 2093056, PROT_NONE) = 0 15:28:29.944375 mmap(0x7f3638c48000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f3638c48000 15:28:29.944509 close(3) = 0 15:28:29.944622 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 15:28:29.944734 open("/usr/lib/x86_64-linux-gnu/libkrb5support.so.0", O_RDONLY|O_CLOEXEC) = 3 15:28:29.944850 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@(\0\0\0\0\0\0@\0\0\0\0\0\0\0\230\243\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\34\0\33\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\34\232\0\0\0\0\0\0\34\232\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0 \235\0\0\0\0\0\0 \235 \0\0\0\0\0 \235 \0\0\0\0\0X\5\0\0\0\0\0\0\350\6\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0X\235\0\0\0\0\0\0X\235 \0\0\0\0\0X\235 \0\0\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\224}\0\0\0\0\0\0\224}\0\0\0\0\0\0\224}\0\0\0\0\0\0T\4\0\0\0\0\0\0T\4\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0 \235\0\0\0\0\0\0 \235 \0\0\0\0\0 \235 \0\0\0\0\0\340\2\0\0\0\0\0\0\340\2\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\2028\177\340\255-#[\227\367\t \37$,\247\333\247,R\0\0\0\0C\0\0\0008\0\0\0\10\0\0\0\t\0\0\0G\214\274\221\v\fI\7\204\214.\0\0\0@\0\0\0A\0\0\0\0\0\0\0B\0\0\0C\0\0\0D\0\0\0G\0\0\0\0\0\0\0\0\0\0\0J\0\0\0L\0\0\0\0\0\0\0M\0\0\0N\0\0\0P\0\0\0Q\0\0\0R\0\0\0\0\0\0\0S\0\0\0\0\0\0\0T\0\0\0U\0\0\0W\0\0\0Y\0\0\0[\0\0\0\\\0\0\0^\0\0\0`\0\0\0\0\0\0\0b\0\0\0\0\0\0\0d\0\0\0e\0\0\0\0\0\0\0g\0\0\0\0\0\0\0j\0\0\0k\0\0\0\0\0\0\0m\0\0\0o\0\0\0q\0\0\0s\0\0\0v\0\0\0x\0\0\0z\0\0\0\0\0\0\0}\0\0\0\200\0\0\0\201\0\0\0\204\0\0\0\205\0\0\0\0\0\0\0\207\0\0\0\210\0\0\0\212\0\0\0\213\0\0\0", 832) = 832 15:28:29.944991 fstat(3, {st_mode=S_IFREG|0644, st_size=43672, ...}) = 0 15:28:29.945318 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a5fa000 15:28:29.945440 mmap(NULL, 2139144, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f363883b000 15:28:29.945547 mprotect(0x7f3638845000, 2093056, PROT_NONE) = 0 15:28:29.945656 mmap(0x7f3638a44000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x9000) = 0x7f3638a44000 15:28:29.945792 close(3) = 0 15:28:29.945921 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 15:28:29.946034 open("/lib/x86_64-linux-gnu/libkeyutils.so.1", O_RDONLY|O_CLOEXEC) = 3 15:28:29.946150 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 \20\0\0\0\0\0\0@\0\0\0\0\0\0\00001\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\32\0\31\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|\37\0\0\0\0\0\0|\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0H-\0\0\0\0\0\0H- \0\0\0\0\0H- \0\0\0\0\0\300\2\0\0\0\0\0\0\310\2\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0`- \0\0\0\0\0\20\2\0\0\0\0\0\0\20\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\250\31\0\0\0\0\0\0\250\31\0\0\0\0\0\0\250\31\0\0\0\0\0\0\f\1\0\0\0\0\0\0\f\1\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0H-\0\0\0\0\0\0H- \0\0\0\0\0H- \0\0\0\0\0\270\2\0\0\0\0\0\0\270\2\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\17\3c_\227\271==\254\330O\16\323c\305k\322f\4O\0\0\0\0%\0\0\0\17\0\0\0\4\0\0\0\10\0\0\0\22\240\0\200\0\222\314B\251 \23(\4\340B2\300:\20\240\10\20I\tP \n\231P\4\2L\17\0\0\0\0\0\0\0\0\0\0\0\21\0\0\0\22\0\0\0\23\0\0\0\0\0\0\0\0\0\0\0\24\0\0\0\26\0\0\0\32\0\0\0\34\0\0\0\35\0\0\0\36\0\0\0!\0\0\0#\0\0\0\0\0\0\0\0\0\0\0%\0\0\0&\0\0\0\0\0\0\0\0\0\0\0'\0\0\0\0\0\0\0(\0\0\0*\0\0\0\0\0\0\0+\0\0\0,\0\0\0-\0\0\0/\0\0\0\0\0\0\0\0\0\0\0000\0\0\0001\0\0\0004\0\0\0006\0\0\0\266,F\277\5i$ \215\211\343\221c\256\376\16\353\323\357\16(yRU\345\306\232\217L\21:\347\206\266\20m6\3621\30\333\6*\312\16/G\315\207\235\26?m\35\361\230Q\21:\347P\21:\347P\271\336\10\0013\206\360v\0\34\37\1\237\224\240\236#\307\2q\257\351\\\347\215A\23373I\315}\335\367\230\224\243@@\331qX\34\273\343\222|\305{?N-\276\311)T\7\322%\263K\264\240CE\325\354\17\r:\347Z}\361\v", 832) = 832 15:28:29.946277 fstat(3, {st_mode=S_IFREG|0644, st_size=14256, ...}) = 0 15:28:29.946400 mmap(NULL, 2109456, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f3638637000 15:28:29.946506 mprotect(0x7f3638639000, 2097152, PROT_NONE) = 0 15:28:29.946612 mmap(0x7f3638839000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f3638839000 15:28:29.946746 close(3) = 0 15:28:29.946858 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 15:28:29.947026 open("/lib/x86_64-linux-gnu/libresolv.so.2", O_RDONLY|O_CLOEXEC) = 3 15:28:29.947224 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320:\0\0\0\0\0\0@\0\0\0\0\0\0\0\270\203\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\37\0\36\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0000A\1\0\0\0\0\0000A\1\0\0\0\0\0000A\1\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20f\1\0\0\0\0\0\20f\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\250t\1\0\0\0\0\0\250t!\0\0\0\0\0\250t!\0\0\0\0\0\330\r\0\0\0\0\0\0\0006\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\210}\1\0\0\0\0\0\210}!\0\0\0\0\0\210}!\0\0\0\0\0\20\2\0\0\0\0\0\0\20\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0008\2\0\0\0\0\0\0008\2\0\0\0\0\0\0008\2\0\0\0\0\0\0D\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0LA\1\0\0\0\0\0LA\1\0\0\0\0\0LA\1\0\0\0\0\0\234\3\0\0\0\0\0\0\234\3\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0\250t\1\0\0\0\0\0\250t!\0\0\0\0\0\250t!\0\0\0\0\0X\v\0\0\0\0\0\0X\v\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\305MV\t\217<\347\250\334\f\10\6\312\31\26z\342n\f5\4\0\0\0\20\0\0\0\1\0\0\0GNU\0\0\0\0\0\2\0\0\0\6\0\0\0\30\0\0\0\0\0\0\0\235\0\0\0B\0\0\0\20\0\0\0\n\0\0\0\0\0@\0\0\0\200\0\0F \24\0013\244\232\202\202\20\0\2\5\1\20!\2\30\1 \220T\207\200@\0 \20\0\0\0\200\10\0\26\304\20\0\20\"\0\2\20\20\30H\4`\304 @ \4B1\6Z\34\200<\20H4\200\0\20\221\1\1\10\204\200\0\0\4@\t\0\0D\0\0\200\4\10\20\1\20H\0@\220\224\32\n\0\20Y\20\201\23\0\10\344\f4\4\0\200\6\20\0!\4\7\1\2411\16B\0\0\0\0\0\0\0\0\0\0\0C\0\0\0D\0\0\0E\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 832) = 832 15:28:29.947367 fstat(3, {st_mode=S_IFREG|0644, st_size=101240, ...}) = 0 15:28:29.947726 mmap(NULL, 2206376, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f363841c000 15:28:29.947851 mprotect(0x7f3638433000, 2097152, PROT_NONE) = 0 15:28:29.947969 mmap(0x7f3638633000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x17000) = 0x7f3638633000 15:28:29.948116 mmap(0x7f3638635000, 6824, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f3638635000 15:28:29.948249 close(3) = 0 15:28:29.948386 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a5f9000 15:28:29.948513 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 15:28:29.948638 open("/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3 15:28:29.948756 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\16\0\0\0\0\0\0@\0\0\0\0\0\0\0\3101\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\36\0\35\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\200\32\0\0\0\0\0\0\200\32\0\0\0\0\0\0\200\32\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0` \0\0\0\0\0\0` \0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0`- \0\0\0\0\0@\3\0\0\0\0\0\0\320\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\210-\0\0\0\0\0\0\210- \0\0\0\0\0\210- \0\0\0\0\0\20\2\0\0\0\0\0\0\20\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0008\2\0\0\0\0\0\0008\2\0\0\0\0\0\0008\2\0\0\0\0\0\0D\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\234\32\0\0\0\0\0\0\234\32\0\0\0\0\0\0\234\32\0\0\0\0\0\0\274\0\0\0\0\0\0\0\274\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0`-\0\0\0\0\0\0`- \0\0\0\0\0`- \0\0\0\0\0\240\2\0\0\0\0\0\0\240\2\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\350>\230\335\2616\371k\214\316\233\351\216\34@\5\335(A\230\4\0\0\0\20\0\0\0\1\0\0\0GNU\0\0\0\0\0\2\0\0\0\6\0\0\0\30\0\0\0\0\0\0\0\33\0\0\0\33\0\0\0\2\0\0\0\7\0\0\0\230\2\21\0\200H\0\4\22\0\0@\203(\10\236\33\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\0\0\0\0\35\0\0\0\0\0\0\0\36\0\0\0\0\0\0\0\37\0\0\0\0\0\0\0 \0\0\0\0\0\0\0!\0\0\0#\0\0\0$\0\0\0&\0\0\0'\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\0\0\0\0\0\0\0\0\353\26\251\30a\257\0\371\301S\200\30\273\25sB\257\304M\17\221!\374\370\6\2\4\371\3733\373\17\371\31sB\372\31sB\225\263_\31\177\236\320\30a\242\222\6", 832) = 832 15:28:29.948915 fstat(3, {st_mode=S_IFREG|0644, st_size=14664, ...}) = 0 15:28:29.949029 mmap(NULL, 2109744, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f3638218000 15:28:29.949137 mprotect(0x7f363821b000, 2093056, PROT_NONE) = 0 15:28:29.949244 mmap(0x7f363841a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f363841a000 15:28:29.949380 close(3) = 0 15:28:29.949537 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a5f8000 15:28:29.949676 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a5f6000 15:28:29.949793 arch_prctl(ARCH_SET_FS, 0x7f363a5f67c0) = 0 15:28:29.950076 mprotect(0x7f3639d84000, 16384, PROT_READ) = 0 15:28:29.950213 mprotect(0x7f363841a000, 4096, PROT_READ) = 0 15:28:29.950338 mprotect(0x7f3638633000, 4096, PROT_READ) = 0 15:28:29.950463 mprotect(0x7f3638839000, 4096, PROT_READ) = 0 15:28:29.950597 mprotect(0x7f3638a44000, 4096, PROT_READ) = 0 15:28:29.950726 mprotect(0x7f363935d000, 4096, PROT_READ) = 0 15:28:29.950848 mprotect(0x7f3638c48000, 4096, PROT_READ) = 0 15:28:29.951024 mprotect(0x7f3638e75000, 8192, PROT_READ) = 0 15:28:29.951364 mprotect(0x7f3639136000, 53248, PROT_READ) = 0 15:28:29.951553 mprotect(0x7f36395a6000, 8192, PROT_READ) = 0 15:28:29.951672 mprotect(0x7f36397ad000, 4096, PROT_READ) = 0 15:28:29.951806 mprotect(0x7f36399c5000, 4096, PROT_READ) = 0 15:28:29.951953 mprotect(0x7f3639fb3000, 4096, PROT_READ) = 0 15:28:29.952101 mprotect(0x7f363a1d8000, 12288, PROT_READ) = 0 15:28:29.952509 mprotect(0x7f363a3e3000, 4096, PROT_READ) = 0 15:28:29.952650 mprotect(0x617000, 4096, PROT_READ) = 0 15:28:29.952770 mprotect(0x7f363a608000, 4096, PROT_READ) = 0 15:28:29.952879 munmap(0x7f363a5fe000, 29633) = 0 15:28:29.953019 set_tid_address(0x7f363a5f6a90) = 4773 15:28:29.953118 set_robust_list(0x7f363a5f6aa0, 24) = 0 15:28:29.953216 futex(0x7fff405e34b0, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f363a5f67c0) = -1 EAGAIN (Resource temporarily unavailable) 15:28:29.953352 rt_sigaction(SIGRTMIN, {0x7f363914ba60, [], SA_RESTORER|SA_SIGINFO, 0x7f3639155320}, NULL, 8) = 0 15:28:29.953481 rt_sigaction(SIGRT_1, {0x7f363914baf0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f3639155320}, NULL, 8) = 0 15:28:29.953592 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 15:28:29.953720 getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 15:28:29.953956 chdir("/var/lib/nfs") = 0 15:28:29.954079 getrlimit(RLIMIT_NOFILE, {rlim_cur=1024, rlim_max=4*1024}) = 0 15:28:29.954219 rt_sigaction(SIGUSR1, {0x40e830, [USR1], SA_RESTORER|SA_RESTART, 0x7f3639a00190}, {SIG_DFL, [], 0}, 8) = 0 15:28:29.954337 rt_sigaction(SIGUSR2, {0x40e830, [USR2], SA_RESTORER|SA_RESTART, 0x7f3639a00190}, {SIG_DFL, [], 0}, 8) = 0 15:28:29.954457 rt_sigaction(SIGHUP, {SIG_IGN, [], SA_RESTORER, 0x7f3639a00190}, NULL, 8) = 0 15:28:29.954565 rt_sigaction(SIGINT, {SIG_IGN, [], SA_RESTORER, 0x7f3639a00190}, NULL, 8) = 0 15:28:29.954671 rt_sigaction(SIGTERM, {SIG_IGN, [], SA_RESTORER, 0x7f3639a00190}, NULL, 8) = 0 15:28:29.954778 rt_sigaction(SIGPIPE, {SIG_IGN, [], SA_RESTORER, 0x7f3639a00190}, NULL, 8) = 0 15:28:29.954884 rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER, 0x7f3639a00190}, NULL, 8) = 0 15:28:29.955076 openat(AT_FDCWD, "/proc/self/fd", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 3 15:28:29.955328 brk(0) = 0x663000 15:28:29.955428 brk(0x68c000) = 0x68c000 15:28:29.955556 getdents(3, /* 6 entries */, 32768) = 144 15:28:29.955709 getdents(3, /* 0 entries */, 32768) = 0 15:28:29.955817 brk(0x684000) = 0x684000 15:28:29.955928 close(3) = 0 15:28:29.956034 access("/proc/fs/nfs/filehandle", F_OK) = -1 ENOENT (No such file or directory) 15:28:29.956166 access("/proc/fs/nfsd/filehandle", F_OK) = 0 15:28:29.956307 open("/proc/net/rpc/auth.unix.ip/channel", O_RDWR) = 3 15:28:29.956474 open("/proc/net/rpc/nfsd.export/channel", O_RDWR) = 4 15:28:29.956634 open("/proc/net/rpc/nfsd.fh/channel", O_RDWR) = 5 15:28:29.956795 socket(PF_LOCAL, SOCK_STREAM, 0) = 6 15:28:29.956928 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.957047 getrlimit(RLIMIT_NOFILE, {rlim_cur=1024, rlim_max=4*1024}) = 0 15:28:29.957186 mmap(NULL, 200704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a5c5000 15:28:29.957624 getpeername(6, 0x7fff405e3130, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:29.957744 connect(6, {sa_family=AF_LOCAL, sun_path="/var/run/rpcbind.sock"}, 23) = 0 15:28:29.957975 getsockname(6, {sa_family=AF_LOCAL, NULL}, [2]) = 0 15:28:29.958140 getsockopt(6, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:29.958255 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.958391 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.958510 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.958647 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.958762 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.958873 geteuid() = 0 15:28:29.959012 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.959166 write(6, "\200\0\0@\22\272\251@\0\0\0\0\0\0\0\2\0\1\206\240\0\0\0\3\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\206\245\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0010\0\0\0", 68) = 68 15:28:29.959324 poll([{fd=6, events=POLLIN}], 1, 60000) = 1 ([{fd=6, revents=POLLIN}]) 15:28:29.959471 read(6, "\200\0\0\34\22\272\251@\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1", 9000) = 32 15:28:29.959589 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.959698 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.959816 close(6) = 0 15:28:29.959956 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.960070 socket(PF_LOCAL, SOCK_STREAM, 0) = 6 15:28:29.960189 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.960303 getpeername(6, 0x7fff405e3130, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:29.960415 connect(6, {sa_family=AF_LOCAL, sun_path="/var/run/rpcbind.sock"}, 23) = 0 15:28:29.960544 getsockname(6, {sa_family=AF_LOCAL, NULL}, [2]) = 0 15:28:29.960642 getsockopt(6, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:29.960761 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.960879 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.960994 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.961107 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.961220 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.961323 geteuid() = 0 15:28:29.961424 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.961545 write(6, "\200\0\0@\22\272\237\215\0\0\0\0\0\0\0\2\0\1\206\240\0\0\0\3\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\206\245\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0010\0\0\0", 68) = 68 15:28:29.961672 poll([{fd=6, events=POLLIN}], 1, 60000) = 1 ([{fd=6, revents=POLLIN}]) 15:28:29.961802 read(6, "\200\0\0\34\22\272\237\215\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1", 9000) = 32 15:28:29.961916 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.962020 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.962148 close(6) = 0 15:28:29.962568 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.962689 socket(PF_LOCAL, SOCK_STREAM, 0) = 6 15:28:29.962851 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.962999 getpeername(6, 0x7fff405e3140, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:29.963127 connect(6, {sa_family=AF_LOCAL, sun_path="/var/run/rpcbind.sock"}, 23) = 0 15:28:29.963269 getsockname(6, {sa_family=AF_LOCAL, NULL}, [2]) = 0 15:28:29.963380 getsockopt(6, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:29.963503 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.963620 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.963735 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.963862 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.963974 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.964079 geteuid() = 0 15:28:29.964178 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.964299 write(6, "\200\0\0@\22\272\202\327\0\0\0\0\0\0\0\2\0\1\206\240\0\0\0\3\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\206\245\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0010\0\0\0", 68) = 68 15:28:29.964418 poll([{fd=6, events=POLLIN}], 1, 60000) = 1 ([{fd=6, revents=POLLIN}]) 15:28:29.964550 read(6, "\200\0\0\34\22\272\202\327\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1", 9000) = 32 15:28:29.964665 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.964773 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.964885 close(6) = 0 15:28:29.964998 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.965111 rt_sigaction(SIGPIPE, {SIG_IGN, [], SA_RESTORER, 0x7f3639a00190}, NULL, 8) = 0 15:28:29.965240 open("/etc/netconfig", O_RDONLY) = 6 15:28:29.965381 fstat(6, {st_mode=S_IFREG|0644, st_size=767, ...}) = 0 15:28:29.965496 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a605000 15:28:29.965750 read(6, "#\n# The network configuration file. This file is currently only used in\n# conjunction with the TI-RPC code in the libtirpc library.\n#\n# Entries consist of:\n#\n# \\\n# \n#\n# The and fields are always empty in this\n# implementation.\n#\nudp tpi_clts v inet udp - -\ntcp tpi_cots_ord v inet tcp - -\nudp6 tpi_clts v inet6 udp - -\ntcp6 tpi_cots_ord v inet6 tcp - -\nrawip tpi_raw - inet - - -\nlocal tpi_cots_ord - loopback - - -\nunix tpi_cots_ord - loopback - - -\n", 4096) = 767 15:28:29.966135 open("/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 7 15:28:29.966257 fstat(7, {st_mode=S_IFREG|0644, st_size=475, ...}) = 0 15:28:29.966365 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:29.966470 read(7, "# /etc/nsswitch.conf\n#\n# Example configuration of GNU Name Service Switch functionality.\n# If you have the `glibc-doc-reference' and `info' packages installed, try:\n# `info libc \"Name Service Switch\"' for information about this file.\n\npasswd: compat\ngroup: compat\nshadow: compat\n\nhosts: files dns\nnetworks: files\n\nprotocols: db files\nservices: db files\nethers: db files\nrpc: db files\n\nnetgroup: nis\n", 4096) = 475 15:28:29.966601 read(7, "", 4096) = 0 15:28:29.966704 close(7) = 0 15:28:29.966803 munmap(0x7f363a604000, 4096) = 0 15:28:29.967045 open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 7 15:28:29.967182 fstat(7, {st_mode=S_IFREG|0644, st_size=29633, ...}) = 0 15:28:29.967291 mmap(NULL, 29633, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7f363a5bd000 15:28:29.967395 close(7) = 0 15:28:29.967502 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 15:28:29.967621 open("/lib/x86_64-linux-gnu/tls/x86_64/libnss_db.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) 15:28:29.967732 stat("/lib/x86_64-linux-gnu/tls/x86_64", 0x7fff405e1f80) = -1 ENOENT (No such file or directory) 15:28:29.967872 open("/lib/x86_64-linux-gnu/tls/libnss_db.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) 15:28:29.967982 stat("/lib/x86_64-linux-gnu/tls", 0x7fff405e1f80) = -1 ENOENT (No such file or directory) 15:28:29.968089 open("/lib/x86_64-linux-gnu/x86_64/libnss_db.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) 15:28:29.968195 stat("/lib/x86_64-linux-gnu/x86_64", 0x7fff405e1f80) = -1 ENOENT (No such file or directory) 15:28:29.968301 open("/lib/x86_64-linux-gnu/libnss_db.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) 15:28:29.968410 stat("/lib/x86_64-linux-gnu", {st_mode=S_IFDIR|0755, st_size=16384, ...}) = 0 15:28:29.968522 open("/usr/lib/x86_64-linux-gnu/tls/x86_64/libnss_db.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) 15:28:29.968632 stat("/usr/lib/x86_64-linux-gnu/tls/x86_64", 0x7fff405e1f80) = -1 ENOENT (No such file or directory) 15:28:29.968740 open("/usr/lib/x86_64-linux-gnu/tls/libnss_db.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) 15:28:29.968846 stat("/usr/lib/x86_64-linux-gnu/tls", 0x7fff405e1f80) = -1 ENOENT (No such file or directory) 15:28:29.968954 open("/usr/lib/x86_64-linux-gnu/x86_64/libnss_db.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) 15:28:29.969063 stat("/usr/lib/x86_64-linux-gnu/x86_64", 0x7fff405e1f80) = -1 ENOENT (No such file or directory) 15:28:29.969168 open("/usr/lib/x86_64-linux-gnu/libnss_db.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) 15:28:29.969279 stat("/usr/lib/x86_64-linux-gnu", {st_mode=S_IFDIR|0755, st_size=20480, ...}) = 0 15:28:29.969390 open("/lib/tls/x86_64/libnss_db.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) 15:28:29.969497 stat("/lib/tls/x86_64", 0x7fff405e1f80) = -1 ENOENT (No such file or directory) 15:28:29.969602 open("/lib/tls/libnss_db.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) 15:28:29.969709 stat("/lib/tls", 0x7fff405e1f80) = -1 ENOENT (No such file or directory) 15:28:29.969815 open("/lib/x86_64/libnss_db.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) 15:28:29.969921 stat("/lib/x86_64", 0x7fff405e1f80) = -1 ENOENT (No such file or directory) 15:28:29.970028 open("/lib/libnss_db.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) 15:28:29.970134 stat("/lib", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 15:28:29.970246 open("/usr/lib/tls/x86_64/libnss_db.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) 15:28:29.970355 stat("/usr/lib/tls/x86_64", 0x7fff405e1f80) = -1 ENOENT (No such file or directory) 15:28:29.970459 open("/usr/lib/tls/libnss_db.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) 15:28:29.970567 stat("/usr/lib/tls", 0x7fff405e1f80) = -1 ENOENT (No such file or directory) 15:28:29.970672 open("/usr/lib/x86_64/libnss_db.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) 15:28:29.970778 stat("/usr/lib/x86_64", 0x7fff405e1f80) = -1 ENOENT (No such file or directory) 15:28:29.970884 open("/usr/lib/libnss_db.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) 15:28:29.971031 stat("/usr/lib", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 15:28:29.971151 munmap(0x7f363a5bd000, 29633) = 0 15:28:29.971291 open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 7 15:28:29.971403 fstat(7, {st_mode=S_IFREG|0644, st_size=29633, ...}) = 0 15:28:29.971505 mmap(NULL, 29633, PROT_READ, MAP_PRIVATE, 7, 0) = 0x7f363a5bd000 15:28:29.971607 close(7) = 0 15:28:29.971707 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 15:28:29.971816 open("/lib/x86_64-linux-gnu/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 7 15:28:29.971930 read(7, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\"\0\0\0\0\0\0@\0\0\0\0\0\0\0\340\262\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\36\0\35\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0@\221\0\0\0\0\0\0@\221\0\0\0\0\0\0@\221\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0p\255\0\0\0\0\0\0p\255\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\210\255\0\0\0\0\0\0\210\255 \0\0\0\0\0\210\255 \0\0\0\0\0(\4\0\0\0\0\0\0\0\v\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\255\0\0\0\0\0\0\240\255 \0\0\0\0\0\240\255 \0\0\0\0\0\20\2\0\0\0\0\0\0\20\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0008\2\0\0\0\0\0\0008\2\0\0\0\0\0\0008\2\0\0\0\0\0\0D\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\\\221\0\0\0\0\0\0\\\221\0\0\0\0\0\0\\\221\0\0\0\0\0\0\224\2\0\0\0\0\0\0\224\2\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0\210\255\0\0\0\0\0\0\210\255 \0\0\0\0\0\210\255 \0\0\0\0\0x\2\0\0\0\0\0\0x\2\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0Y\223>\370%\340\354\342`\344{4r\30\261\317)\3327\316\4\0\0\0\20\0\0\0\1\0\0\0GNU\0\0\0\0\0\2\0\0\0\6\0\0\0\30\0\0\0\0\0\0\0k\0\0\0000\0\0\0\10\0\0\0\t\0\0\0\22F\344\25\240\245\201\0\t\10\0028\223\6\310\0\0\0z\0]\201\240Jx\2108*\220\200\0$\7!\5\24)\"\226<\0\4\0\33\0\20\2\0\0@\10\201\3100\200\200B@\206\0\302\0\200\3000\0\0\0001\0\0\0\0\0\0\0002\0\0\0003\0\0\0004\0\0\0005\0\0\0006\0\0\0\0\0\0\0007\0\0\0\0\0\0\0008\0\0\0:\0\0\0;\0\0\0\0\0\0\0=\0\0\0\0\0\0\0?\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\0\0\0B\0\0\0\0\0\0\0C\0\0\0", 832) = 832 15:28:29.972070 fstat(7, {st_mode=S_IFREG|0644, st_size=47712, ...}) = 0 15:28:29.972438 mmap(NULL, 2144392, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 7, 0) = 0x7f363800c000 15:28:29.972549 mprotect(0x7f3638017000, 2093056, PROT_NONE) = 0 15:28:29.972660 mmap(0x7f3638216000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 7, 0xa000) = 0x7f3638216000 15:28:29.972805 close(7) = 0 15:28:29.972962 mprotect(0x7f3638216000, 4096, PROT_READ) = 0 15:28:29.973070 munmap(0x7f363a5bd000, 29633) = 0 15:28:29.973218 open("/etc/rpc", O_RDONLY|O_CLOEXEC) = 7 15:28:29.973344 fstat(7, {st_mode=S_IFREG|0644, st_size=887, ...}) = 0 15:28:29.973449 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:29.973555 read(7, "# This file contains user readable names that can be used in place of rpc\n# program numbers.\n\nportmapper\t100000\tportmap sunrpc\nrstatd\t\t100001\trstat rstat_svc rup perfmeter\nrusersd\t\t100002\trusers\nnfs\t\t100003\tnfsprog\nypserv\t\t100004\typprog\nmountd\t\t100005\tmount showmount\nypbind\t\t100007\nwalld\t\t100008\trwall shutdown\nyppasswdd\t100009\typpasswd\netherstatd\t100010\tetherstat\nrquotad\t\t100011\trquotaprog quota rquota\nsprayd\t\t100012\tspray\n3270_mapper\t100013\nrje_mapper\t100014\nselection_svc\t100015\tselnsvc\ndatabase_svc\t100016\nrexd\t\t100017\trex\nalis\t\t100018\nsched\t\t100019\nllockmgr\t100020\nnlockmgr\t100021\nx25.inr\t\t100022\nstatmon\t\t100023\nstatus\t\t100024\nbootparam\t100026\nypupdated\t100028\typupdate\nkeyserv\t\t100029\tkeyserver\ntfsd\t\t100037 \nnsed\t\t100038\nnsemntd\t\t100039\nypxfrd\t\t100069\npcnfsd\t\t150001\namd\t\t300019\tamq\nsgi_fam\t\t391002\nugidd\t\t545580417\nfypxfrd\t\t600100069\tfreebsd-ypxfrd\nbwnfsd 788585389\n", 4096) = 887 15:28:29.973703 close(7) = 0 15:28:29.973800 munmap(0x7f363a604000, 4096) = 0 15:28:29.973978 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7 15:28:29.974252 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) 15:28:29.974396 close(7) = 0 15:28:29.974509 socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7 15:28:29.974610 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) 15:28:29.974729 close(7) = 0 15:28:29.974846 open("/etc/services", O_RDONLY|O_CLOEXEC) = 7 15:28:29.975006 fstat(7, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:29.975118 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:29.975245 read(7, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:29.975764 read(7, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:29.975981 read(7, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:29.976193 read(7, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:29.976393 read(7, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:29.976573 read(7, "", 4096) = 0 15:28:29.976676 close(7) = 0 15:28:29.976776 munmap(0x7f363a604000, 4096) = 0 15:28:29.976908 open("/etc/services", O_RDONLY|O_CLOEXEC) = 7 15:28:29.977026 fstat(7, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:29.977130 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:29.977235 read(7, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:29.977458 read(7, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:29.977669 read(7, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:29.977878 read(7, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:29.978076 read(7, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:29.978254 read(7, "", 4096) = 0 15:28:29.978355 close(7) = 0 15:28:29.978453 munmap(0x7f363a604000, 4096) = 0 15:28:29.978564 open("/etc/services", O_RDONLY|O_CLOEXEC) = 7 15:28:29.978674 fstat(7, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:29.978778 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:29.978881 read(7, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:29.979135 read(7, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:29.979332 read(7, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:29.979549 read(7, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:29.979750 read(7, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:29.979926 read(7, "", 4096) = 0 15:28:29.980025 close(7) = 0 15:28:29.980124 munmap(0x7f363a604000, 4096) = 0 15:28:29.980262 socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP) = 7 15:28:29.980377 bind(7, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 15:28:29.980509 listen(7, 128) = -1 EOPNOTSUPP (Operation not supported) 15:28:29.980610 getsockname(7, {sa_family=AF_INET, sin_port=htons(39654), sin_addr=inet_addr("0.0.0.0")}, [16]) = 0 15:28:29.980722 getsockopt(7, SOL_SOCKET, SO_TYPE, [2], [4]) = 0 15:28:29.980838 getsockname(7, {sa_family=AF_INET, sin_port=htons(39654), sin_addr=inet_addr("0.0.0.0")}, [16]) = 0 15:28:29.980952 setsockopt(7, SOL_IP, IP_PKTINFO, [1], 4) = 0 15:28:29.981102 socket(PF_LOCAL, SOCK_STREAM, 0) = 8 15:28:29.981210 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.981323 getpeername(8, 0x7fff405e2fb0, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:29.981431 connect(8, {sa_family=AF_LOCAL, sun_path="/var/run/rpcbind.sock"}, 23) = 0 15:28:29.981626 getsockname(8, {sa_family=AF_LOCAL, NULL}, [2]) = 0 15:28:29.981771 getsockopt(8, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:29.981886 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.982007 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.982750 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.983012 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.983159 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.983333 geteuid() = 0 15:28:29.983437 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.983564 write(8, "\200\0\0T\22\272\315\1\0\0\0\0\0\0\0\2\0\1\206\240\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\206\245\0\0\0\1\0\0\0\3udp\0\0\0\0\0170.0.0.0.154.230\0\0\0\0\0010\0\0\0", 88) = 88 15:28:29.983694 poll([{fd=8, events=POLLIN}], 1, 60000) = 1 ([{fd=8, revents=POLLIN}]) 15:28:29.983834 read(8, "\200\0\0\34\22\272\315\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1", 9000) = 32 15:28:29.983958 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.984067 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.984181 close(8) = 0 15:28:29.984319 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.984453 open("/etc/rpc", O_RDONLY|O_CLOEXEC) = 8 15:28:29.984589 fstat(8, {st_mode=S_IFREG|0644, st_size=887, ...}) = 0 15:28:29.984705 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:29.984824 read(8, "# This file contains user readable names that can be used in place of rpc\n# program numbers.\n\nportmapper\t100000\tportmap sunrpc\nrstatd\t\t100001\trstat rstat_svc rup perfmeter\nrusersd\t\t100002\trusers\nnfs\t\t100003\tnfsprog\nypserv\t\t100004\typprog\nmountd\t\t100005\tmount showmount\nypbind\t\t100007\nwalld\t\t100008\trwall shutdown\nyppasswdd\t100009\typpasswd\netherstatd\t100010\tetherstat\nrquotad\t\t100011\trquotaprog quota rquota\nsprayd\t\t100012\tspray\n3270_mapper\t100013\nrje_mapper\t100014\nselection_svc\t100015\tselnsvc\ndatabase_svc\t100016\nrexd\t\t100017\trex\nalis\t\t100018\nsched\t\t100019\nllockmgr\t100020\nnlockmgr\t100021\nx25.inr\t\t100022\nstatmon\t\t100023\nstatus\t\t100024\nbootparam\t100026\nypupdated\t100028\typupdate\nkeyserv\t\t100029\tkeyserver\ntfsd\t\t100037 \nnsed\t\t100038\nnsemntd\t\t100039\nypxfrd\t\t100069\npcnfsd\t\t150001\namd\t\t300019\tamq\nsgi_fam\t\t391002\nugidd\t\t545580417\nfypxfrd\t\t600100069\tfreebsd-ypxfrd\nbwnfsd 788585389\n", 4096) = 887 15:28:29.984969 close(8) = 0 15:28:29.985069 munmap(0x7f363a604000, 4096) = 0 15:28:29.985204 open("/etc/services", O_RDONLY|O_CLOEXEC) = 8 15:28:29.985316 fstat(8, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:29.985423 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:29.985527 read(8, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:29.985790 read(8, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:29.985988 read(8, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:29.986207 read(8, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:29.986390 read(8, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:29.986577 read(8, "", 4096) = 0 15:28:29.986679 close(8) = 0 15:28:29.986777 munmap(0x7f363a604000, 4096) = 0 15:28:29.986891 open("/etc/services", O_RDONLY|O_CLOEXEC) = 8 15:28:29.987030 fstat(8, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:29.987140 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:29.987243 read(8, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:29.987461 read(8, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:29.987654 read(8, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:29.987869 read(8, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:29.988054 read(8, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:29.988241 read(8, "", 4096) = 0 15:28:29.988343 close(8) = 0 15:28:29.988440 munmap(0x7f363a604000, 4096) = 0 15:28:29.988552 open("/etc/services", O_RDONLY|O_CLOEXEC) = 8 15:28:29.988664 fstat(8, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:29.988769 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:29.988873 read(8, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:29.989074 read(8, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:29.989281 read(8, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:29.989498 read(8, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:29.989682 read(8, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:29.989866 read(8, "", 4096) = 0 15:28:29.989969 close(8) = 0 15:28:29.990068 munmap(0x7f363a604000, 4096) = 0 15:28:29.990189 socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 8 15:28:29.990310 bind(8, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 15:28:29.990427 listen(8, 128) = 0 15:28:29.990543 getpeername(8, 0x7fff405e3170, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:29.990659 getsockname(8, {sa_family=AF_INET, sin_port=htons(35557), sin_addr=inet_addr("0.0.0.0")}, [16]) = 0 15:28:29.990769 getsockopt(8, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:29.990883 getsockname(8, {sa_family=AF_INET, sin_port=htons(35557), sin_addr=inet_addr("0.0.0.0")}, [16]) = 0 15:28:29.991046 socket(PF_LOCAL, SOCK_STREAM, 0) = 9 15:28:29.991155 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.991270 getpeername(9, 0x7fff405e2fb0, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:29.991378 connect(9, {sa_family=AF_LOCAL, sun_path="/var/run/rpcbind.sock"}, 23) = 0 15:28:29.991537 getsockname(9, {sa_family=AF_LOCAL, NULL}, [2]) = 0 15:28:29.991647 getsockopt(9, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:29.991760 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.991882 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.991995 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.992144 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.992504 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.992626 geteuid() = 0 15:28:29.992728 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.992851 write(9, "\200\0\0T\22\273\24\255\0\0\0\0\0\0\0\2\0\1\206\240\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\206\245\0\0\0\1\0\0\0\3tcp\0\0\0\0\0170.0.0.0.138.229\0\0\0\0\0010\0\0\0", 88) = 88 15:28:29.993012 poll([{fd=9, events=POLLIN}], 1, 60000) = 1 ([{fd=9, revents=POLLIN}]) 15:28:29.993156 read(9, "\200\0\0\34\22\273\24\255\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1", 9000) = 32 15:28:29.993274 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.993379 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:29.993493 close(9) = 0 15:28:29.993607 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:29.993740 open("/etc/rpc", O_RDONLY|O_CLOEXEC) = 9 15:28:29.993870 fstat(9, {st_mode=S_IFREG|0644, st_size=887, ...}) = 0 15:28:29.993982 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:29.994097 read(9, "# This file contains user readable names that can be used in place of rpc\n# program numbers.\n\nportmapper\t100000\tportmap sunrpc\nrstatd\t\t100001\trstat rstat_svc rup perfmeter\nrusersd\t\t100002\trusers\nnfs\t\t100003\tnfsprog\nypserv\t\t100004\typprog\nmountd\t\t100005\tmount showmount\nypbind\t\t100007\nwalld\t\t100008\trwall shutdown\nyppasswdd\t100009\typpasswd\netherstatd\t100010\tetherstat\nrquotad\t\t100011\trquotaprog quota rquota\nsprayd\t\t100012\tspray\n3270_mapper\t100013\nrje_mapper\t100014\nselection_svc\t100015\tselnsvc\ndatabase_svc\t100016\nrexd\t\t100017\trex\nalis\t\t100018\nsched\t\t100019\nllockmgr\t100020\nnlockmgr\t100021\nx25.inr\t\t100022\nstatmon\t\t100023\nstatus\t\t100024\nbootparam\t100026\nypupdated\t100028\typupdate\nkeyserv\t\t100029\tkeyserver\ntfsd\t\t100037 \nnsed\t\t100038\nnsemntd\t\t100039\nypxfrd\t\t100069\npcnfsd\t\t150001\namd\t\t300019\tamq\nsgi_fam\t\t391002\nugidd\t\t545580417\nfypxfrd\t\t600100069\tfreebsd-ypxfrd\nbwnfsd 788585389\n", 4096) = 887 15:28:29.994275 close(9) = 0 15:28:29.994378 munmap(0x7f363a604000, 4096) = 0 15:28:29.994503 open("/etc/services", O_RDONLY|O_CLOEXEC) = 9 15:28:29.994617 fstat(9, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:29.994725 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:29.994827 read(9, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:29.995090 read(9, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:29.995312 read(9, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:29.995521 read(9, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:29.995721 read(9, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:29.995897 read(9, "", 4096) = 0 15:28:29.995999 close(9) = 0 15:28:29.996113 munmap(0x7f363a604000, 4096) = 0 15:28:29.996231 open("/etc/services", O_RDONLY|O_CLOEXEC) = 9 15:28:29.996344 fstat(9, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:29.996452 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:29.996557 read(9, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:29.996760 read(9, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:29.996969 read(9, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:29.997174 read(9, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:29.997369 read(9, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:29.997544 read(9, "", 4096) = 0 15:28:29.997646 close(9) = 0 15:28:29.997743 munmap(0x7f363a604000, 4096) = 0 15:28:29.997855 open("/etc/services", O_RDONLY|O_CLOEXEC) = 9 15:28:29.997968 fstat(9, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:29.998073 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:29.998177 read(9, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:29.998392 read(9, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:29.998598 read(9, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:29.998801 read(9, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:29.999035 read(9, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:29.999231 read(9, "", 4096) = 0 15:28:29.999315 close(9) = 0 15:28:29.999396 munmap(0x7f363a604000, 4096) = 0 15:28:29.999509 socket(PF_INET6, SOCK_DGRAM, IPPROTO_UDP) = 9 15:28:29.999609 setsockopt(9, SOL_IPV6, IPV6_V6ONLY, [1], 4) = 0 15:28:29.999736 bind(9, {sa_family=AF_INET6, sin6_port=htons(0), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = 0 15:28:29.999885 listen(9, 128) = -1 EOPNOTSUPP (Operation not supported) 15:28:29.999993 getsockname(9, {sa_family=AF_INET6, sin6_port=htons(59083), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 0 15:28:30.000110 getsockopt(9, SOL_SOCKET, SO_TYPE, [2], [4]) = 0 15:28:30.000239 getsockname(9, {sa_family=AF_INET6, sin6_port=htons(59083), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 0 15:28:30.000386 setsockopt(9, SOL_IPV6, 0x31 /* IPV6_??? */, [1], 4) = 0 15:28:30.000510 socket(PF_LOCAL, SOCK_STREAM, 0) = 10 15:28:30.000634 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.000755 getpeername(10, 0x7fff405e2fb0, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:30.000865 connect(10, {sa_family=AF_LOCAL, sun_path="/var/run/rpcbind.sock"}, 23) = 0 15:28:30.001049 getsockname(10, {sa_family=AF_LOCAL, NULL}, [2]) = 0 15:28:30.001188 getsockopt(10, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:30.001302 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.001422 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.001545 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.001678 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.001797 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.001915 geteuid() = 0 15:28:30.002018 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.002167 write(10, "\200\0\0P\22\2643\250\0\0\0\0\0\0\0\2\0\1\206\240\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\206\245\0\0\0\1\0\0\0\4udp6\0\0\0\n::.230.203\0\0\0\0\0\0010\0\0\0", 84) = 84 15:28:30.002379 poll([{fd=10, events=POLLIN}], 1, 60000) = 1 ([{fd=10, revents=POLLIN}]) 15:28:30.002504 read(10, "\200\0\0\34\22\2643\250\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1", 9000) = 32 15:28:30.002634 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.002744 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.002859 close(10) = 0 15:28:30.003041 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.003185 open("/etc/rpc", O_RDONLY|O_CLOEXEC) = 10 15:28:30.003313 fstat(10, {st_mode=S_IFREG|0644, st_size=887, ...}) = 0 15:28:30.003426 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.003539 read(10, "# This file contains user readable names that can be used in place of rpc\n# program numbers.\n\nportmapper\t100000\tportmap sunrpc\nrstatd\t\t100001\trstat rstat_svc rup perfmeter\nrusersd\t\t100002\trusers\nnfs\t\t100003\tnfsprog\nypserv\t\t100004\typprog\nmountd\t\t100005\tmount showmount\nypbind\t\t100007\nwalld\t\t100008\trwall shutdown\nyppasswdd\t100009\typpasswd\netherstatd\t100010\tetherstat\nrquotad\t\t100011\trquotaprog quota rquota\nsprayd\t\t100012\tspray\n3270_mapper\t100013\nrje_mapper\t100014\nselection_svc\t100015\tselnsvc\ndatabase_svc\t100016\nrexd\t\t100017\trex\nalis\t\t100018\nsched\t\t100019\nllockmgr\t100020\nnlockmgr\t100021\nx25.inr\t\t100022\nstatmon\t\t100023\nstatus\t\t100024\nbootparam\t100026\nypupdated\t100028\typupdate\nkeyserv\t\t100029\tkeyserver\ntfsd\t\t100037 \nnsed\t\t100038\nnsemntd\t\t100039\nypxfrd\t\t100069\npcnfsd\t\t150001\namd\t\t300019\tamq\nsgi_fam\t\t391002\nugidd\t\t545580417\nfypxfrd\t\t600100069\tfreebsd-ypxfrd\nbwnfsd 788585389\n", 4096) = 887 15:28:30.003685 close(10) = 0 15:28:30.003786 munmap(0x7f363a604000, 4096) = 0 15:28:30.003908 open("/etc/services", O_RDONLY|O_CLOEXEC) = 10 15:28:30.004020 fstat(10, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.004127 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.004231 read(10, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.004478 read(10, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.004677 read(10, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.004892 read(10, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.005091 read(10, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.005265 read(10, "", 4096) = 0 15:28:30.005369 close(10) = 0 15:28:30.005469 munmap(0x7f363a604000, 4096) = 0 15:28:30.005583 open("/etc/services", O_RDONLY|O_CLOEXEC) = 10 15:28:30.005697 fstat(10, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.005806 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.005912 read(10, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.006124 read(10, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.006316 read(10, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.006527 read(10, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.006711 read(10, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.006902 read(10, "", 4096) = 0 15:28:30.007029 close(10) = 0 15:28:30.007126 munmap(0x7f363a604000, 4096) = 0 15:28:30.007236 open("/etc/services", O_RDONLY|O_CLOEXEC) = 10 15:28:30.007346 fstat(10, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.007451 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.007552 read(10, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.007761 read(10, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.007950 read(10, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.008159 read(10, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.008338 read(10, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.008519 read(10, "", 4096) = 0 15:28:30.008620 close(10) = 0 15:28:30.008717 munmap(0x7f363a604000, 4096) = 0 15:28:30.008836 socket(PF_INET6, SOCK_STREAM, IPPROTO_TCP) = 10 15:28:30.008951 setsockopt(10, SOL_IPV6, IPV6_V6ONLY, [1], 4) = 0 15:28:30.009061 bind(10, {sa_family=AF_INET6, sin6_port=htons(0), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = 0 15:28:30.009177 listen(10, 128) = 0 15:28:30.009292 getpeername(10, 0x7fff405e3170, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:30.009405 getsockname(10, {sa_family=AF_INET6, sin6_port=htons(38596), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 0 15:28:30.009515 getsockopt(10, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:30.009624 getsockname(10, {sa_family=AF_INET6, sin6_port=htons(38596), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 0 15:28:30.009741 socket(PF_LOCAL, SOCK_STREAM, 0) = 11 15:28:30.009850 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.009963 getpeername(11, 0x7fff405e2fb0, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:30.010068 connect(11, {sa_family=AF_LOCAL, sun_path="/var/run/rpcbind.sock"}, 23) = 0 15:28:30.010225 getsockname(11, {sa_family=AF_LOCAL, NULL}, [2]) = 0 15:28:30.010332 getsockopt(11, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:30.010437 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.010569 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.010684 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.010810 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.010923 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.011176 geteuid() = 0 15:28:30.011280 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.011405 write(11, "\200\0\0P\22\264\37\355\0\0\0\0\0\0\0\2\0\1\206\240\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\206\245\0\0\0\1\0\0\0\4tcp6\0\0\0\n::.150.196\0\0\0\0\0\0010\0\0\0", 84) = 84 15:28:30.011528 poll([{fd=11, events=POLLIN}], 1, 60000) = 1 ([{fd=11, revents=POLLIN}]) 15:28:30.011663 read(11, "\200\0\0\34\22\264\37\355\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1", 9000) = 32 15:28:30.011783 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.011891 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.012037 close(11) = 0 15:28:30.012159 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.012293 read(6, "", 4096) = 0 15:28:30.012417 close(6) = 0 15:28:30.012514 munmap(0x7f363a605000, 4096) = 0 15:28:30.012636 rt_sigaction(SIGPIPE, {SIG_IGN, [], SA_RESTORER, 0x7f3639a00190}, NULL, 8) = 0 15:28:30.012753 open("/etc/netconfig", O_RDONLY) = 6 15:28:30.012876 fstat(6, {st_mode=S_IFREG|0644, st_size=767, ...}) = 0 15:28:30.012987 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a605000 15:28:30.013098 read(6, "#\n# The network configuration file. This file is currently only used in\n# conjunction with the TI-RPC code in the libtirpc library.\n#\n# Entries consist of:\n#\n# \\\n# \n#\n# The and fields are always empty in this\n# implementation.\n#\nudp tpi_clts v inet udp - -\ntcp tpi_cots_ord v inet tcp - -\nudp6 tpi_clts v inet6 udp - -\ntcp6 tpi_cots_ord v inet6 tcp - -\nrawip tpi_raw - inet - - -\nlocal tpi_cots_ord - loopback - - -\nunix tpi_cots_ord - loopback - - -\n", 4096) = 767 15:28:30.013234 open("/etc/rpc", O_RDONLY|O_CLOEXEC) = 11 15:28:30.013347 fstat(11, {st_mode=S_IFREG|0644, st_size=887, ...}) = 0 15:28:30.013454 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.013555 read(11, "# This file contains user readable names that can be used in place of rpc\n# program numbers.\n\nportmapper\t100000\tportmap sunrpc\nrstatd\t\t100001\trstat rstat_svc rup perfmeter\nrusersd\t\t100002\trusers\nnfs\t\t100003\tnfsprog\nypserv\t\t100004\typprog\nmountd\t\t100005\tmount showmount\nypbind\t\t100007\nwalld\t\t100008\trwall shutdown\nyppasswdd\t100009\typpasswd\netherstatd\t100010\tetherstat\nrquotad\t\t100011\trquotaprog quota rquota\nsprayd\t\t100012\tspray\n3270_mapper\t100013\nrje_mapper\t100014\nselection_svc\t100015\tselnsvc\ndatabase_svc\t100016\nrexd\t\t100017\trex\nalis\t\t100018\nsched\t\t100019\nllockmgr\t100020\nnlockmgr\t100021\nx25.inr\t\t100022\nstatmon\t\t100023\nstatus\t\t100024\nbootparam\t100026\nypupdated\t100028\typupdate\nkeyserv\t\t100029\tkeyserver\ntfsd\t\t100037 \nnsed\t\t100038\nnsemntd\t\t100039\nypxfrd\t\t100069\npcnfsd\t\t150001\namd\t\t300019\tamq\nsgi_fam\t\t391002\nugidd\t\t545580417\nfypxfrd\t\t600100069\tfreebsd-ypxfrd\nbwnfsd 788585389\n", 4096) = 887 15:28:30.013690 close(11) = 0 15:28:30.013790 munmap(0x7f363a604000, 4096) = 0 15:28:30.013901 open("/etc/services", O_RDONLY|O_CLOEXEC) = 11 15:28:30.014012 fstat(11, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.014121 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.014223 read(11, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.014454 read(11, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.014648 read(11, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.014862 read(11, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.015083 read(11, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.015268 read(11, "", 4096) = 0 15:28:30.015373 close(11) = 0 15:28:30.015472 munmap(0x7f363a604000, 4096) = 0 15:28:30.015582 open("/etc/services", O_RDONLY|O_CLOEXEC) = 11 15:28:30.015695 fstat(11, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.015801 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.015903 read(11, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.016114 read(11, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.016305 read(11, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.016516 read(11, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.016698 read(11, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.016883 read(11, "", 4096) = 0 15:28:30.016985 close(11) = 0 15:28:30.017082 munmap(0x7f363a604000, 4096) = 0 15:28:30.017193 open("/etc/services", O_RDONLY|O_CLOEXEC) = 11 15:28:30.017305 fstat(11, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.017410 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.017513 read(11, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.017724 read(11, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.017914 read(11, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.018126 read(11, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.018308 read(11, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.018491 read(11, "", 4096) = 0 15:28:30.018594 close(11) = 0 15:28:30.018691 munmap(0x7f363a604000, 4096) = 0 15:28:30.018813 socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP) = 11 15:28:30.018933 bind(11, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 15:28:30.019084 listen(11, 128) = -1 EOPNOTSUPP (Operation not supported) 15:28:30.019190 getsockname(11, {sa_family=AF_INET, sin_port=htons(45404), sin_addr=inet_addr("0.0.0.0")}, [16]) = 0 15:28:30.019303 getsockopt(11, SOL_SOCKET, SO_TYPE, [2], [4]) = 0 15:28:30.019435 getsockname(11, {sa_family=AF_INET, sin_port=htons(45404), sin_addr=inet_addr("0.0.0.0")}, [16]) = 0 15:28:30.019778 setsockopt(11, SOL_IP, IP_PKTINFO, [1], 4) = 0 15:28:30.019896 socket(PF_LOCAL, SOCK_STREAM, 0) = 12 15:28:30.020009 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.020124 getpeername(12, 0x7fff405e2fb0, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:30.020231 connect(12, {sa_family=AF_LOCAL, sun_path="/var/run/rpcbind.sock"}, 23) = 0 15:28:30.020417 getsockname(12, {sa_family=AF_LOCAL, NULL}, [2]) = 0 15:28:30.020557 getsockopt(12, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:30.020672 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.020791 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.020909 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.021048 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.021162 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.021283 geteuid() = 0 15:28:30.021384 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.021506 write(12, "\200\0\0T\22\264g\314\0\0\0\0\0\0\0\2\0\1\206\240\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\206\245\0\0\0\2\0\0\0\3udp\0\0\0\0\0160.0.0.0.177.92\0\0\0\0\0\0010\0\0\0", 88) = 88 15:28:30.021648 poll([{fd=12, events=POLLIN}], 1, 60000) = 1 ([{fd=12, revents=POLLIN}]) 15:28:30.021783 read(12, "\200\0\0\34\22\264g\314\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1", 9000) = 32 15:28:30.021898 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.022003 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.022115 close(12) = 0 15:28:30.022540 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.022674 open("/etc/rpc", O_RDONLY|O_CLOEXEC) = 12 15:28:30.022800 fstat(12, {st_mode=S_IFREG|0644, st_size=887, ...}) = 0 15:28:30.022913 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.023064 read(12, "# This file contains user readable names that can be used in place of rpc\n# program numbers.\n\nportmapper\t100000\tportmap sunrpc\nrstatd\t\t100001\trstat rstat_svc rup perfmeter\nrusersd\t\t100002\trusers\nnfs\t\t100003\tnfsprog\nypserv\t\t100004\typprog\nmountd\t\t100005\tmount showmount\nypbind\t\t100007\nwalld\t\t100008\trwall shutdown\nyppasswdd\t100009\typpasswd\netherstatd\t100010\tetherstat\nrquotad\t\t100011\trquotaprog quota rquota\nsprayd\t\t100012\tspray\n3270_mapper\t100013\nrje_mapper\t100014\nselection_svc\t100015\tselnsvc\ndatabase_svc\t100016\nrexd\t\t100017\trex\nalis\t\t100018\nsched\t\t100019\nllockmgr\t100020\nnlockmgr\t100021\nx25.inr\t\t100022\nstatmon\t\t100023\nstatus\t\t100024\nbootparam\t100026\nypupdated\t100028\typupdate\nkeyserv\t\t100029\tkeyserver\ntfsd\t\t100037 \nnsed\t\t100038\nnsemntd\t\t100039\nypxfrd\t\t100069\npcnfsd\t\t150001\namd\t\t300019\tamq\nsgi_fam\t\t391002\nugidd\t\t545580417\nfypxfrd\t\t600100069\tfreebsd-ypxfrd\nbwnfsd 788585389\n", 4096) = 887 15:28:30.023249 close(12) = 0 15:28:30.023347 munmap(0x7f363a604000, 4096) = 0 15:28:30.023470 open("/etc/services", O_RDONLY|O_CLOEXEC) = 12 15:28:30.023585 fstat(12, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.023690 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.023793 read(12, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.024008 read(12, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.024227 read(12, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.024448 read(12, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.024636 read(12, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.024825 read(12, "", 4096) = 0 15:28:30.024928 close(12) = 0 15:28:30.025028 munmap(0x7f363a604000, 4096) = 0 15:28:30.025139 open("/etc/services", O_RDONLY|O_CLOEXEC) = 12 15:28:30.025253 fstat(12, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.025360 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.025462 read(12, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.025667 read(12, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.025870 read(12, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.026075 read(12, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.026272 read(12, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.026460 read(12, "", 4096) = 0 15:28:30.026562 close(12) = 0 15:28:30.026659 munmap(0x7f363a604000, 4096) = 0 15:28:30.026769 open("/etc/services", O_RDONLY|O_CLOEXEC) = 12 15:28:30.026880 fstat(12, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.027026 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.027129 read(12, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.027329 read(12, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.027534 read(12, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.027738 read(12, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.027932 read(12, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.028107 read(12, "", 4096) = 0 15:28:30.028208 close(12) = 0 15:28:30.028304 munmap(0x7f363a604000, 4096) = 0 15:28:30.028426 socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 12 15:28:30.028572 bind(12, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 15:28:30.028690 listen(12, 128) = 0 15:28:30.028806 getpeername(12, 0x7fff405e3170, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:30.028920 getsockname(12, {sa_family=AF_INET, sin_port=htons(48116), sin_addr=inet_addr("0.0.0.0")}, [16]) = 0 15:28:30.029030 getsockopt(12, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:30.029141 getsockname(12, {sa_family=AF_INET, sin_port=htons(48116), sin_addr=inet_addr("0.0.0.0")}, [16]) = 0 15:28:30.029261 socket(PF_LOCAL, SOCK_STREAM, 0) = 13 15:28:30.029367 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.029482 getpeername(13, 0x7fff405e2fb0, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:30.029587 connect(13, {sa_family=AF_LOCAL, sun_path="/var/run/rpcbind.sock"}, 23) = 0 15:28:30.029744 getsockname(13, {sa_family=AF_LOCAL, NULL}, [2]) = 0 15:28:30.029852 getsockopt(13, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:30.029967 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.030088 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.030203 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.030331 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.030446 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.030564 geteuid() = 0 15:28:30.030666 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.030786 write(13, "\200\0\0T\22\264C\274\0\0\0\0\0\0\0\2\0\1\206\240\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\206\245\0\0\0\2\0\0\0\3tcp\0\0\0\0\0170.0.0.0.187.244\0\0\0\0\0010\0\0\0", 88) = 88 15:28:30.030927 poll([{fd=13, events=POLLIN}], 1, 60000) = 1 ([{fd=13, revents=POLLIN}]) 15:28:30.031115 read(13, "\200\0\0\34\22\264C\274\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1", 9000) = 32 15:28:30.031232 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.031339 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.031450 close(13) = 0 15:28:30.031581 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.031708 open("/etc/rpc", O_RDONLY|O_CLOEXEC) = 13 15:28:30.031832 fstat(13, {st_mode=S_IFREG|0644, st_size=887, ...}) = 0 15:28:30.031944 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.032051 read(13, "# This file contains user readable names that can be used in place of rpc\n# program numbers.\n\nportmapper\t100000\tportmap sunrpc\nrstatd\t\t100001\trstat rstat_svc rup perfmeter\nrusersd\t\t100002\trusers\nnfs\t\t100003\tnfsprog\nypserv\t\t100004\typprog\nmountd\t\t100005\tmount showmount\nypbind\t\t100007\nwalld\t\t100008\trwall shutdown\nyppasswdd\t100009\typpasswd\netherstatd\t100010\tetherstat\nrquotad\t\t100011\trquotaprog quota rquota\nsprayd\t\t100012\tspray\n3270_mapper\t100013\nrje_mapper\t100014\nselection_svc\t100015\tselnsvc\ndatabase_svc\t100016\nrexd\t\t100017\trex\nalis\t\t100018\nsched\t\t100019\nllockmgr\t100020\nnlockmgr\t100021\nx25.inr\t\t100022\nstatmon\t\t100023\nstatus\t\t100024\nbootparam\t100026\nypupdated\t100028\typupdate\nkeyserv\t\t100029\tkeyserver\ntfsd\t\t100037 \nnsed\t\t100038\nnsemntd\t\t100039\nypxfrd\t\t100069\npcnfsd\t\t150001\namd\t\t300019\tamq\nsgi_fam\t\t391002\nugidd\t\t545580417\nfypxfrd\t\t600100069\tfreebsd-ypxfrd\nbwnfsd 788585389\n", 4096) = 887 15:28:30.032194 close(13) = 0 15:28:30.032295 munmap(0x7f363a604000, 4096) = 0 15:28:30.032414 open("/etc/services", O_RDONLY|O_CLOEXEC) = 13 15:28:30.032525 fstat(13, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.032631 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.032732 read(13, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.032962 read(13, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.033167 read(13, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.033369 read(13, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.033561 read(13, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.033734 read(13, "", 4096) = 0 15:28:30.033836 close(13) = 0 15:28:30.033932 munmap(0x7f363a604000, 4096) = 0 15:28:30.034045 open("/etc/services", O_RDONLY|O_CLOEXEC) = 13 15:28:30.034157 fstat(13, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.034261 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.034365 read(13, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.034575 read(13, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.034766 read(13, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.035015 read(13, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.035213 read(13, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.035385 read(13, "", 4096) = 0 15:28:30.035488 close(13) = 0 15:28:30.035585 munmap(0x7f363a604000, 4096) = 0 15:28:30.035695 open("/etc/services", O_RDONLY|O_CLOEXEC) = 13 15:28:30.035804 fstat(13, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.035909 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.036010 read(13, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.036221 read(13, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.036411 read(13, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.036625 read(13, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.036810 read(13, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.036994 read(13, "", 4096) = 0 15:28:30.037094 close(13) = 0 15:28:30.037193 munmap(0x7f363a604000, 4096) = 0 15:28:30.037314 socket(PF_INET6, SOCK_DGRAM, IPPROTO_UDP) = 13 15:28:30.037425 setsockopt(13, SOL_IPV6, IPV6_V6ONLY, [1], 4) = 0 15:28:30.037535 bind(13, {sa_family=AF_INET6, sin6_port=htons(0), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = 0 15:28:30.037651 listen(13, 128) = -1 EOPNOTSUPP (Operation not supported) 15:28:30.037752 getsockname(13, {sa_family=AF_INET6, sin6_port=htons(41423), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 0 15:28:30.037865 getsockopt(13, SOL_SOCKET, SO_TYPE, [2], [4]) = 0 15:28:30.037986 getsockname(13, {sa_family=AF_INET6, sin6_port=htons(41423), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 0 15:28:30.038098 setsockopt(13, SOL_IPV6, 0x31 /* IPV6_??? */, [1], 4) = 0 15:28:30.038210 socket(PF_LOCAL, SOCK_STREAM, 0) = 14 15:28:30.038319 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.038430 getpeername(14, 0x7fff405e2fb0, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:30.038538 connect(14, {sa_family=AF_LOCAL, sun_path="/var/run/rpcbind.sock"}, 23) = 0 15:28:30.038680 getsockname(14, {sa_family=AF_LOCAL, NULL}, [2]) = 0 15:28:30.038802 getsockopt(14, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:30.038924 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.039086 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.039201 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.039337 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.039447 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.039563 geteuid() = 0 15:28:30.039662 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.039799 write(14, "\200\0\0P\22\264\256I\0\0\0\0\0\0\0\2\0\1\206\240\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\206\245\0\0\0\2\0\0\0\4udp6\0\0\0\n::.161.207\0\0\0\0\0\0010\0\0\0", 84) = 84 15:28:30.039922 poll([{fd=14, events=POLLIN}], 1, 60000) = 1 ([{fd=14, revents=POLLIN}]) 15:28:30.040060 read(14, "\200\0\0\34\22\264\256I\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1", 9000) = 32 15:28:30.040180 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.040289 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.040404 close(14) = 0 15:28:30.040549 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.040681 open("/etc/rpc", O_RDONLY|O_CLOEXEC) = 14 15:28:30.040806 fstat(14, {st_mode=S_IFREG|0644, st_size=887, ...}) = 0 15:28:30.040916 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.041031 read(14, "# This file contains user readable names that can be used in place of rpc\n# program numbers.\n\nportmapper\t100000\tportmap sunrpc\nrstatd\t\t100001\trstat rstat_svc rup perfmeter\nrusersd\t\t100002\trusers\nnfs\t\t100003\tnfsprog\nypserv\t\t100004\typprog\nmountd\t\t100005\tmount showmount\nypbind\t\t100007\nwalld\t\t100008\trwall shutdown\nyppasswdd\t100009\typpasswd\netherstatd\t100010\tetherstat\nrquotad\t\t100011\trquotaprog quota rquota\nsprayd\t\t100012\tspray\n3270_mapper\t100013\nrje_mapper\t100014\nselection_svc\t100015\tselnsvc\ndatabase_svc\t100016\nrexd\t\t100017\trex\nalis\t\t100018\nsched\t\t100019\nllockmgr\t100020\nnlockmgr\t100021\nx25.inr\t\t100022\nstatmon\t\t100023\nstatus\t\t100024\nbootparam\t100026\nypupdated\t100028\typupdate\nkeyserv\t\t100029\tkeyserver\ntfsd\t\t100037 \nnsed\t\t100038\nnsemntd\t\t100039\nypxfrd\t\t100069\npcnfsd\t\t150001\namd\t\t300019\tamq\nsgi_fam\t\t391002\nugidd\t\t545580417\nfypxfrd\t\t600100069\tfreebsd-ypxfrd\nbwnfsd 788585389\n", 4096) = 887 15:28:30.041177 close(14) = 0 15:28:30.041276 munmap(0x7f363a604000, 4096) = 0 15:28:30.041403 open("/etc/services", O_RDONLY|O_CLOEXEC) = 14 15:28:30.041517 fstat(14, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.041622 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.041729 read(14, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.041976 read(14, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.042194 read(14, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.042436 read(14, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.042606 read(14, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.042777 read(14, "", 4096) = 0 15:28:30.042862 close(14) = 0 15:28:30.042977 munmap(0x7f363a604000, 4096) = 0 15:28:30.043081 open("/etc/services", O_RDONLY|O_CLOEXEC) = 14 15:28:30.043181 fstat(14, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.043272 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.043359 read(14, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.043560 read(14, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.043736 read(14, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.043938 read(14, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.044107 read(14, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.044275 read(14, "", 4096) = 0 15:28:30.044358 close(14) = 0 15:28:30.044437 munmap(0x7f363a604000, 4096) = 0 15:28:30.044532 open("/etc/services", O_RDONLY|O_CLOEXEC) = 14 15:28:30.044627 fstat(14, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.044713 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.044798 read(14, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.044979 read(14, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.045166 read(14, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.045382 read(14, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.045599 read(14, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.046042 read(14, "", 4096) = 0 15:28:30.046151 close(14) = 0 15:28:30.046252 munmap(0x7f363a604000, 4096) = 0 15:28:30.046382 socket(PF_INET6, SOCK_STREAM, IPPROTO_TCP) = 14 15:28:30.046503 setsockopt(14, SOL_IPV6, IPV6_V6ONLY, [1], 4) = 0 15:28:30.046619 bind(14, {sa_family=AF_INET6, sin6_port=htons(0), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = 0 15:28:30.046740 listen(14, 128) = 0 15:28:30.046857 getpeername(14, 0x7fff405e3170, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:30.047002 getsockname(14, {sa_family=AF_INET6, sin6_port=htons(46985), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 0 15:28:30.047121 getsockopt(14, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:30.047235 getsockname(14, {sa_family=AF_INET6, sin6_port=htons(46985), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 0 15:28:30.047359 socket(PF_LOCAL, SOCK_STREAM, 0) = 15 15:28:30.047470 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.047590 getpeername(15, 0x7fff405e2fb0, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:30.047697 connect(15, {sa_family=AF_LOCAL, sun_path="/var/run/rpcbind.sock"}, 23) = 0 15:28:30.047847 getsockname(15, {sa_family=AF_LOCAL, NULL}, [2]) = 0 15:28:30.047947 getsockopt(15, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:30.048062 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.048186 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.048302 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.048424 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.048540 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.048657 geteuid() = 0 15:28:30.048761 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.048883 write(15, "\200\0\0P\22\264\212\360\0\0\0\0\0\0\0\2\0\1\206\240\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\206\245\0\0\0\2\0\0\0\4tcp6\0\0\0\n::.183.137\0\0\0\0\0\0010\0\0\0", 84) = 84 15:28:30.049025 poll([{fd=15, events=POLLIN}], 1, 60000) = 1 ([{fd=15, revents=POLLIN}]) 15:28:30.049165 read(15, "\200\0\0\34\22\264\212\360\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1", 9000) = 32 15:28:30.049282 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.049388 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.049501 close(15) = 0 15:28:30.049628 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.049757 read(6, "", 4096) = 0 15:28:30.049867 close(6) = 0 15:28:30.049965 munmap(0x7f363a605000, 4096) = 0 15:28:30.050084 rt_sigaction(SIGPIPE, {SIG_IGN, [], SA_RESTORER, 0x7f3639a00190}, NULL, 8) = 0 15:28:30.050200 open("/etc/netconfig", O_RDONLY) = 6 15:28:30.050320 fstat(6, {st_mode=S_IFREG|0644, st_size=767, ...}) = 0 15:28:30.050431 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a605000 15:28:30.050541 read(6, "#\n# The network configuration file. This file is currently only used in\n# conjunction with the TI-RPC code in the libtirpc library.\n#\n# Entries consist of:\n#\n# \\\n# \n#\n# The and fields are always empty in this\n# implementation.\n#\nudp tpi_clts v inet udp - -\ntcp tpi_cots_ord v inet tcp - -\nudp6 tpi_clts v inet6 udp - -\ntcp6 tpi_cots_ord v inet6 tcp - -\nrawip tpi_raw - inet - - -\nlocal tpi_cots_ord - loopback - - -\nunix tpi_cots_ord - loopback - - -\n", 4096) = 767 15:28:30.050705 open("/etc/rpc", O_RDONLY|O_CLOEXEC) = 15 15:28:30.050820 fstat(15, {st_mode=S_IFREG|0644, st_size=887, ...}) = 0 15:28:30.050927 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.051068 read(15, "# This file contains user readable names that can be used in place of rpc\n# program numbers.\n\nportmapper\t100000\tportmap sunrpc\nrstatd\t\t100001\trstat rstat_svc rup perfmeter\nrusersd\t\t100002\trusers\nnfs\t\t100003\tnfsprog\nypserv\t\t100004\typprog\nmountd\t\t100005\tmount showmount\nypbind\t\t100007\nwalld\t\t100008\trwall shutdown\nyppasswdd\t100009\typpasswd\netherstatd\t100010\tetherstat\nrquotad\t\t100011\trquotaprog quota rquota\nsprayd\t\t100012\tspray\n3270_mapper\t100013\nrje_mapper\t100014\nselection_svc\t100015\tselnsvc\ndatabase_svc\t100016\nrexd\t\t100017\trex\nalis\t\t100018\nsched\t\t100019\nllockmgr\t100020\nnlockmgr\t100021\nx25.inr\t\t100022\nstatmon\t\t100023\nstatus\t\t100024\nbootparam\t100026\nypupdated\t100028\typupdate\nkeyserv\t\t100029\tkeyserver\ntfsd\t\t100037 \nnsed\t\t100038\nnsemntd\t\t100039\nypxfrd\t\t100069\npcnfsd\t\t150001\namd\t\t300019\tamq\nsgi_fam\t\t391002\nugidd\t\t545580417\nfypxfrd\t\t600100069\tfreebsd-ypxfrd\nbwnfsd 788585389\n", 4096) = 887 15:28:30.051205 close(15) = 0 15:28:30.051305 munmap(0x7f363a604000, 4096) = 0 15:28:30.051419 open("/etc/services", O_RDONLY|O_CLOEXEC) = 15 15:28:30.051533 fstat(15, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.051640 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.051742 read(15, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.051961 read(15, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.052154 read(15, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.052367 read(15, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.052551 read(15, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.052736 read(15, "", 4096) = 0 15:28:30.052839 close(15) = 0 15:28:30.052937 munmap(0x7f363a604000, 4096) = 0 15:28:30.053049 open("/etc/services", O_RDONLY|O_CLOEXEC) = 15 15:28:30.053163 fstat(15, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.053272 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.053380 read(15, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.053581 read(15, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.053783 read(15, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.053998 read(15, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.054181 read(15, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.054362 read(15, "", 4096) = 0 15:28:30.054465 close(15) = 0 15:28:30.054565 munmap(0x7f363a604000, 4096) = 0 15:28:30.054673 open("/etc/services", O_RDONLY|O_CLOEXEC) = 15 15:28:30.054784 fstat(15, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.054892 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.055037 read(15, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.055239 read(15, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.055441 read(15, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.055654 read(15, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.055837 read(15, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.056020 read(15, "", 4096) = 0 15:28:30.056123 close(15) = 0 15:28:30.056222 munmap(0x7f363a604000, 4096) = 0 15:28:30.056343 socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP) = 15 15:28:30.056459 bind(15, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 15:28:30.056578 listen(15, 128) = -1 EOPNOTSUPP (Operation not supported) 15:28:30.056681 getsockname(15, {sa_family=AF_INET, sin_port=htons(55925), sin_addr=inet_addr("0.0.0.0")}, [16]) = 0 15:28:30.056796 getsockopt(15, SOL_SOCKET, SO_TYPE, [2], [4]) = 0 15:28:30.056918 getsockname(15, {sa_family=AF_INET, sin_port=htons(55925), sin_addr=inet_addr("0.0.0.0")}, [16]) = 0 15:28:30.057030 setsockopt(15, SOL_IP, IP_PKTINFO, [1], 4) = 0 15:28:30.057146 socket(PF_LOCAL, SOCK_STREAM, 0) = 16 15:28:30.057255 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.057368 getpeername(16, 0x7fff405e2fb0, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:30.057477 connect(16, {sa_family=AF_LOCAL, sun_path="/var/run/rpcbind.sock"}, 23) = 0 15:28:30.057624 getsockname(16, {sa_family=AF_LOCAL, NULL}, [2]) = 0 15:28:30.057747 getsockopt(16, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:30.057871 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.057986 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.058101 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.058237 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.058351 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.058467 geteuid() = 0 15:28:30.058565 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.058688 write(16, "\200\0\0T\22\264\324\275\0\0\0\0\0\0\0\2\0\1\206\240\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\206\245\0\0\0\3\0\0\0\3udp\0\0\0\0\0170.0.0.0.218.117\0\0\0\0\0010\0\0\0", 88) = 88 15:28:30.058807 poll([{fd=16, events=POLLIN}], 1, 60000) = 1 ([{fd=16, revents=POLLIN}]) 15:28:30.058979 read(16, "\200\0\0\34\22\264\324\275\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1", 9000) = 32 15:28:30.059103 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.059213 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.059327 close(16) = 0 15:28:30.059446 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.059575 open("/etc/rpc", O_RDONLY|O_CLOEXEC) = 16 15:28:30.059698 fstat(16, {st_mode=S_IFREG|0644, st_size=887, ...}) = 0 15:28:30.059808 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.059916 read(16, "# This file contains user readable names that can be used in place of rpc\n# program numbers.\n\nportmapper\t100000\tportmap sunrpc\nrstatd\t\t100001\trstat rstat_svc rup perfmeter\nrusersd\t\t100002\trusers\nnfs\t\t100003\tnfsprog\nypserv\t\t100004\typprog\nmountd\t\t100005\tmount showmount\nypbind\t\t100007\nwalld\t\t100008\trwall shutdown\nyppasswdd\t100009\typpasswd\netherstatd\t100010\tetherstat\nrquotad\t\t100011\trquotaprog quota rquota\nsprayd\t\t100012\tspray\n3270_mapper\t100013\nrje_mapper\t100014\nselection_svc\t100015\tselnsvc\ndatabase_svc\t100016\nrexd\t\t100017\trex\nalis\t\t100018\nsched\t\t100019\nllockmgr\t100020\nnlockmgr\t100021\nx25.inr\t\t100022\nstatmon\t\t100023\nstatus\t\t100024\nbootparam\t100026\nypupdated\t100028\typupdate\nkeyserv\t\t100029\tkeyserver\ntfsd\t\t100037 \nnsed\t\t100038\nnsemntd\t\t100039\nypxfrd\t\t100069\npcnfsd\t\t150001\namd\t\t300019\tamq\nsgi_fam\t\t391002\nugidd\t\t545580417\nfypxfrd\t\t600100069\tfreebsd-ypxfrd\nbwnfsd 788585389\n", 4096) = 887 15:28:30.060076 close(16) = 0 15:28:30.060176 munmap(0x7f363a604000, 4096) = 0 15:28:30.060294 open("/etc/services", O_RDONLY|O_CLOEXEC) = 16 15:28:30.060405 fstat(16, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.060509 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.060609 read(16, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.060816 read(16, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.061023 read(16, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.061227 read(16, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.061422 read(16, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.061597 read(16, "", 4096) = 0 15:28:30.061697 close(16) = 0 15:28:30.061792 munmap(0x7f363a604000, 4096) = 0 15:28:30.061905 open("/etc/services", O_RDONLY|O_CLOEXEC) = 16 15:28:30.062015 fstat(16, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.062118 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.062219 read(16, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.062437 read(16, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.062639 read(16, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.062841 read(16, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.063114 read(16, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.063295 read(16, "", 4096) = 0 15:28:30.063396 close(16) = 0 15:28:30.063494 munmap(0x7f363a604000, 4096) = 0 15:28:30.063608 open("/etc/services", O_RDONLY|O_CLOEXEC) = 16 15:28:30.063719 fstat(16, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.063827 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.063931 read(16, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.064144 read(16, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.064351 read(16, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.064554 read(16, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.064748 read(16, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.064924 read(16, "", 4096) = 0 15:28:30.065026 close(16) = 0 15:28:30.065123 munmap(0x7f363a604000, 4096) = 0 15:28:30.065243 socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 16 15:28:30.065359 bind(16, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 15:28:30.065474 listen(16, 128) = 0 15:28:30.065587 getpeername(16, 0x7fff405e3170, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:30.065700 getsockname(16, {sa_family=AF_INET, sin_port=htons(48751), sin_addr=inet_addr("0.0.0.0")}, [16]) = 0 15:28:30.065811 getsockopt(16, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:30.065922 getsockname(16, {sa_family=AF_INET, sin_port=htons(48751), sin_addr=inet_addr("0.0.0.0")}, [16]) = 0 15:28:30.066040 socket(PF_LOCAL, SOCK_STREAM, 0) = 17 15:28:30.066146 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.066259 getpeername(17, 0x7fff405e2fb0, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:30.066365 connect(17, {sa_family=AF_LOCAL, sun_path="/var/run/rpcbind.sock"}, 23) = 0 15:28:30.066513 getsockname(17, {sa_family=AF_LOCAL, NULL}, [2]) = 0 15:28:30.066619 getsockopt(17, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:30.066778 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.066898 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.067078 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.067205 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.067319 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.067436 geteuid() = 0 15:28:30.067536 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.067657 write(17, "\200\0\0T\22\2653\354\0\0\0\0\0\0\0\2\0\1\206\240\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\206\245\0\0\0\3\0\0\0\3tcp\0\0\0\0\0170.0.0.0.190.111\0\0\0\0\0010\0\0\0", 88) = 88 15:28:30.067779 poll([{fd=17, events=POLLIN}], 1, 60000) = 1 ([{fd=17, revents=POLLIN}]) 15:28:30.067905 read(17, "\200\0\0\34\22\2653\354\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1", 9000) = 32 15:28:30.068023 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.068128 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.068241 close(17) = 0 15:28:30.068359 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.068487 open("/etc/rpc", O_RDONLY|O_CLOEXEC) = 17 15:28:30.068612 fstat(17, {st_mode=S_IFREG|0644, st_size=887, ...}) = 0 15:28:30.068723 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.068833 read(17, "# This file contains user readable names that can be used in place of rpc\n# program numbers.\n\nportmapper\t100000\tportmap sunrpc\nrstatd\t\t100001\trstat rstat_svc rup perfmeter\nrusersd\t\t100002\trusers\nnfs\t\t100003\tnfsprog\nypserv\t\t100004\typprog\nmountd\t\t100005\tmount showmount\nypbind\t\t100007\nwalld\t\t100008\trwall shutdown\nyppasswdd\t100009\typpasswd\netherstatd\t100010\tetherstat\nrquotad\t\t100011\trquotaprog quota rquota\nsprayd\t\t100012\tspray\n3270_mapper\t100013\nrje_mapper\t100014\nselection_svc\t100015\tselnsvc\ndatabase_svc\t100016\nrexd\t\t100017\trex\nalis\t\t100018\nsched\t\t100019\nllockmgr\t100020\nnlockmgr\t100021\nx25.inr\t\t100022\nstatmon\t\t100023\nstatus\t\t100024\nbootparam\t100026\nypupdated\t100028\typupdate\nkeyserv\t\t100029\tkeyserver\ntfsd\t\t100037 \nnsed\t\t100038\nnsemntd\t\t100039\nypxfrd\t\t100069\npcnfsd\t\t150001\namd\t\t300019\tamq\nsgi_fam\t\t391002\nugidd\t\t545580417\nfypxfrd\t\t600100069\tfreebsd-ypxfrd\nbwnfsd 788585389\n", 4096) = 887 15:28:30.068977 close(17) = 0 15:28:30.069078 munmap(0x7f363a604000, 4096) = 0 15:28:30.069197 open("/etc/services", O_RDONLY|O_CLOEXEC) = 17 15:28:30.069310 fstat(17, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.069417 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.069519 read(17, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.069749 read(17, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.069942 read(17, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.070155 read(17, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.070341 read(17, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.070529 read(17, "", 4096) = 0 15:28:30.070635 close(17) = 0 15:28:30.070735 munmap(0x7f363a604000, 4096) = 0 15:28:30.070848 open("/etc/services", O_RDONLY|O_CLOEXEC) = 17 15:28:30.071001 fstat(17, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.071138 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.071253 read(17, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.071499 read(17, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.071695 read(17, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.071910 read(17, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.072096 read(17, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.072286 read(17, "", 4096) = 0 15:28:30.072392 close(17) = 0 15:28:30.072491 munmap(0x7f363a604000, 4096) = 0 15:28:30.072622 open("/etc/services", O_RDONLY|O_CLOEXEC) = 17 15:28:30.072747 fstat(17, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.072855 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.072960 read(17, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.073169 read(17, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.073361 read(17, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.073574 read(17, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.073757 read(17, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.073939 read(17, "", 4096) = 0 15:28:30.074042 close(17) = 0 15:28:30.074141 munmap(0x7f363a604000, 4096) = 0 15:28:30.074263 socket(PF_INET6, SOCK_DGRAM, IPPROTO_UDP) = 17 15:28:30.074380 setsockopt(17, SOL_IPV6, IPV6_V6ONLY, [1], 4) = 0 15:28:30.074491 bind(17, {sa_family=AF_INET6, sin6_port=htons(0), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = 0 15:28:30.074605 listen(17, 128) = -1 EOPNOTSUPP (Operation not supported) 15:28:30.074710 getsockname(17, {sa_family=AF_INET6, sin6_port=htons(51988), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 0 15:28:30.074823 getsockopt(17, SOL_SOCKET, SO_TYPE, [2], [4]) = 0 15:28:30.074974 getsockname(17, {sa_family=AF_INET6, sin6_port=htons(51988), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 0 15:28:30.075093 setsockopt(17, SOL_IPV6, 0x31 /* IPV6_??? */, [1], 4) = 0 15:28:30.075208 socket(PF_LOCAL, SOCK_STREAM, 0) = 18 15:28:30.075315 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.075431 getpeername(18, 0x7fff405e2fb0, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:30.075538 connect(18, {sa_family=AF_LOCAL, sun_path="/var/run/rpcbind.sock"}, 23) = 0 15:28:30.075693 getsockname(18, {sa_family=AF_LOCAL, NULL}, [2]) = 0 15:28:30.075797 getsockopt(18, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:30.075923 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.076041 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.076156 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.076286 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.076401 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.076516 geteuid() = 0 15:28:30.076617 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.076740 write(18, "\200\0\0P\22\265\36%\0\0\0\0\0\0\0\2\0\1\206\240\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\206\245\0\0\0\3\0\0\0\4udp6\0\0\0\t::.203.20\0\0\0\0\0\0\0010\0\0\0", 84) = 84 15:28:30.076876 poll([{fd=18, events=POLLIN}], 1, 60000) = 1 ([{fd=18, revents=POLLIN}]) 15:28:30.077012 read(18, "\200\0\0\34\22\265\36%\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1", 9000) = 32 15:28:30.077127 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.077231 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.077344 close(18) = 0 15:28:30.077469 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.077600 open("/etc/rpc", O_RDONLY|O_CLOEXEC) = 18 15:28:30.077722 fstat(18, {st_mode=S_IFREG|0644, st_size=887, ...}) = 0 15:28:30.077831 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.077941 read(18, "# This file contains user readable names that can be used in place of rpc\n# program numbers.\n\nportmapper\t100000\tportmap sunrpc\nrstatd\t\t100001\trstat rstat_svc rup perfmeter\nrusersd\t\t100002\trusers\nnfs\t\t100003\tnfsprog\nypserv\t\t100004\typprog\nmountd\t\t100005\tmount showmount\nypbind\t\t100007\nwalld\t\t100008\trwall shutdown\nyppasswdd\t100009\typpasswd\netherstatd\t100010\tetherstat\nrquotad\t\t100011\trquotaprog quota rquota\nsprayd\t\t100012\tspray\n3270_mapper\t100013\nrje_mapper\t100014\nselection_svc\t100015\tselnsvc\ndatabase_svc\t100016\nrexd\t\t100017\trex\nalis\t\t100018\nsched\t\t100019\nllockmgr\t100020\nnlockmgr\t100021\nx25.inr\t\t100022\nstatmon\t\t100023\nstatus\t\t100024\nbootparam\t100026\nypupdated\t100028\typupdate\nkeyserv\t\t100029\tkeyserver\ntfsd\t\t100037 \nnsed\t\t100038\nnsemntd\t\t100039\nypxfrd\t\t100069\npcnfsd\t\t150001\namd\t\t300019\tamq\nsgi_fam\t\t391002\nugidd\t\t545580417\nfypxfrd\t\t600100069\tfreebsd-ypxfrd\nbwnfsd 788585389\n", 4096) = 887 15:28:30.078107 close(18) = 0 15:28:30.078209 munmap(0x7f363a604000, 4096) = 0 15:28:30.078327 open("/etc/services", O_RDONLY|O_CLOEXEC) = 18 15:28:30.078440 fstat(18, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.078548 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.078651 read(18, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.078855 read(18, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.079113 read(18, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.079329 read(18, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.079511 read(18, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.079697 read(18, "", 4096) = 0 15:28:30.079800 close(18) = 0 15:28:30.079898 munmap(0x7f363a604000, 4096) = 0 15:28:30.080011 open("/etc/services", O_RDONLY|O_CLOEXEC) = 18 15:28:30.080123 fstat(18, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.080228 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.080332 read(18, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.080527 read(18, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.080729 read(18, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.080928 read(18, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.081119 read(18, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.081303 read(18, "", 4096) = 0 15:28:30.081404 close(18) = 0 15:28:30.081499 munmap(0x7f363a604000, 4096) = 0 15:28:30.081610 open("/etc/services", O_RDONLY|O_CLOEXEC) = 18 15:28:30.081720 fstat(18, {st_mode=S_IFREG|0644, st_size=19558, ...}) = 0 15:28:30.081823 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a604000 15:28:30.081926 read(18, "# Network services, Internet style\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, officially ports have two entries\n# even if the protocol doesn't support UDP operations.\n#\n# Updated from http://www.iana.org/assignments/port-numbers and other\n# sources like http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/services .\n# New ports will be added on request if they have been officially assigned\n# by IANA and used in the real-world or are needed by a debian package.\n# If you need a huge list of used numbers please install the nmap package.\n\ntcpmux\t\t1/tcp\t\t\t\t# TCP port service multiplexer\necho\t\t7/tcp\necho\t\t7/udp\ndiscard\t\t9/tcp\t\tsink null\ndiscard\t\t9/udp\t\tsink null\nsystat\t\t11/tcp\t\tusers\ndaytime\t\t13/tcp\ndaytime\t\t13/udp\nnetstat\t\t15/tcp\nqotd\t\t17/tcp\t\tquote\nmsp\t\t18/tcp\t\t\t\t# message send protocol\nmsp\t\t18/udp\nchargen\t\t19/tcp\t\tttytst source\nchargen\t\t19/udp\t\tttytst source\nftp-data\t20/tcp\nftp\t\t21/tcp\nfsp\t\t21/udp\t\tfspd\nssh\t\t22/tcp\t\t\t\t# SSH Remote Login Protocol\nssh\t\t22/udp\ntelnet\t\t23/tcp\nsmtp\t\t25/tcp\t\tmail\ntime\t\t37/tcp\t\ttimserver\ntime\t\t37/udp\t\ttimserver\nrlp\t\t39/udp\t\tresource\t# resource location\nnameserver\t42/tcp\t\tname\t\t# IEN 116\nwhois\t\t43/tcp\t\tnicname\ntacacs\t\t49/tcp\t\t\t\t# Login Host Protocol (TACACS)\ntacacs\t\t49/udp\nre-mail-ck\t50/tcp\t\t\t\t# Remote Mail Checking Protocol\nre-mail-ck\t50/udp\ndomain\t\t53/tcp\t\t\t\t# Domain Name Server\ndomain\t\t53/udp\nmtp\t\t57/tcp\t\t\t\t# deprecated\ntacacs-ds\t65/tcp\t\t\t\t# TACACS-Database Service\ntacacs-ds\t65/udp\nbootps\t\t67/tcp\t\t\t\t# BOOTP server\nbootps\t\t67/udp\nbootpc\t\t68/tcp\t\t\t\t# BOOTP client\nbootpc\t\t68/udp\ntftp\t\t69/udp\ngopher\t\t70/tcp\t\t\t\t# Internet Gopher\ngopher\t\t70/udp\nrje\t\t77/tcp\t\tnetrjs\nfinger\t\t79/tcp\nhttp\t\t80/tcp\t\twww\t\t# WorldWideWeb HTTP\nhttp\t\t80/udp\t\t\t\t# HyperText Transfer Protocol\nlink\t\t87/tcp\t\tttylink\nkerberos\t88/tcp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nkerberos\t88/udp\t\tkerberos5 krb5 kerberos-sec\t# Kerberos v5\nsupdup\t\t95/tcp\nhostnames\t101/tcp\t\thostname\t# usually from sri-nic\niso-tsap\t10"..., 4096) = 4096 15:28:30.082123 read(18, "\t\t# IPX\nipx\t\t213/udp\nimap3\t\t220/tcp\t\t\t\t# Interactive Mail Access\nimap3\t\t220/udp\t\t\t\t# Protocol v3\npawserv\t\t345/tcp\t\t\t\t# Perf Analysis Workbench\npawserv\t\t345/udp\nzserv\t\t346/tcp\t\t\t\t# Zebra server\nzserv\t\t346/udp\nfatserv\t\t347/tcp\t\t\t\t# Fatmen Server\nfatserv\t\t347/udp\nrpc2portmap\t369/tcp\nrpc2portmap\t369/udp\t\t\t\t# Coda portmapper\ncodaauth2\t370/tcp\ncodaauth2\t370/udp\t\t\t\t# Coda authentication server\nclearcase\t371/tcp\t\tClearcase\nclearcase\t371/udp\t\tClearcase\nulistserv\t372/tcp\t\t\t\t# UNIX Listserv\nulistserv\t372/udp\nldap\t\t389/tcp\t\t\t# Lightweight Directory Access Protocol\nldap\t\t389/udp\nimsp\t\t406/tcp\t\t\t# Interactive Mail Support Protocol\nimsp\t\t406/udp\nsvrloc\t\t427/tcp\t\t\t\t# Server Location\nsvrloc\t\t427/udp\nhttps\t\t443/tcp\t\t\t\t# http protocol over TLS/SSL\nhttps\t\t443/udp\nsnpp\t\t444/tcp\t\t\t\t# Simple Network Paging Protocol\nsnpp\t\t444/udp\nmicrosoft-ds\t445/tcp\t\t\t\t# Microsoft Naked CIFS\nmicrosoft-ds\t445/udp\nkpasswd\t\t464/tcp\nkpasswd\t\t464/udp\nurd\t\t465/tcp\t\tssmtp smtps # URL Rendesvous Directory for SSM\nsaft\t\t487/tcp\t\t\t# Simple Asynchronous File Transfer\nsaft\t\t487/udp\nisakmp\t\t500/tcp\t\t\t# IPsec - Internet Security Association\nisakmp\t\t500/udp\t\t\t# and Key Management Protocol\nrtsp\t\t554/tcp\t\t\t# Real Time Stream Control Protocol\nrtsp\t\t554/udp\nnqs\t\t607/tcp\t\t\t\t# Network Queuing system\nnqs\t\t607/udp\nnpmp-local\t610/tcp\t\tdqs313_qmaster\t\t# npmp-local / DQS\nnpmp-local\t610/udp\t\tdqs313_qmaster\nnpmp-gui\t611/tcp\t\tdqs313_execd\t\t# npmp-gui / DQS\nnpmp-gui\t611/udp\t\tdqs313_execd\nhmmp-ind\t612/tcp\t\tdqs313_intercell\t# HMMP Indication / DQS\nhmmp-ind\t612/udp\t\tdqs313_intercell\nasf-rmcp\t623/udp\t\t# ASF Remote Management and Control Protocol\nqmqp\t\t628/tcp\nqmqp\t\t628/udp\nipp\t\t631/tcp\t\t\t\t# Internet Printing Protocol\nipp\t\t631/udp\n#\n# UNIX specific services\n#\nexec\t\t512/tcp\nbiff\t\t512/udp\t\tcomsat\nlogin\t\t513/tcp\nwho\t\t513/udp\t\twhod\nshell\t\t514/tcp\t\tcmd\t\t# no passwords used\nsyslog\t\t514/udp\nprinter\t\t515/tcp\t\tspooler\t\t# line printer spooler\ntalk\t\t517/udp\nntalk\t\t518/udp\nroute\t\t520/udp\t\trouter routed\t# RIP\ntimed\t\t525/udp\t\ttimeserver\ntempo\t\t526/tcp"..., 4096) = 4096 15:28:30.082652 read(18, "nessus\t\t1241/tcp\t\t\t# Nessus vulnerability\nnessus\t\t1241/udp\t\t\t# assessment scanner\nlotusnote\t1352/tcp\tlotusnotes\t# Lotus Note\nlotusnote\t1352/udp\tlotusnotes\nms-sql-s\t1433/tcp\t\t\t# Microsoft SQL Server\nms-sql-s\t1433/udp\nms-sql-m\t1434/tcp\t\t\t# Microsoft SQL Monitor\nms-sql-m\t1434/udp\ningreslock\t1524/tcp\ningreslock\t1524/udp\nprospero-np\t1525/tcp\t\t\t# Prospero non-privileged\nprospero-np\t1525/udp\ndatametrics\t1645/tcp\told-radius\ndatametrics\t1645/udp\told-radius\nsa-msg-port\t1646/tcp\told-radacct\nsa-msg-port\t1646/udp\told-radacct\nkermit\t\t1649/tcp\nkermit\t\t1649/udp\ngroupwise\t1677/tcp\ngroupwise\t1677/udp\nl2f\t\t1701/tcp\tl2tp\nl2f\t\t1701/udp\tl2tp\nradius\t\t1812/tcp\nradius\t\t1812/udp\nradius-acct\t1813/tcp\tradacct\t\t# Radius Accounting\nradius-acct\t1813/udp\tradacct\nmsnp\t\t1863/tcp\t\t\t# MSN Messenger\nmsnp\t\t1863/udp\nunix-status\t1957/tcp\t\t\t# remstats unix-status server\nlog-server\t1958/tcp\t\t\t# remstats log server\nremoteping\t1959/tcp\t\t\t# remstats remoteping server\ncisco-sccp\t2000/tcp\t\t\t# Cisco SCCP\ncisco-sccp\t2000/udp\nsearch\t\t2010/tcp\tndtp\npipe-server\t2010/tcp\tpipe_server\nnfs\t\t2049/tcp\t\t\t# Network File System\nnfs\t\t2049/udp\t\t\t# Network File System\ngnunet\t\t2086/tcp\ngnunet\t\t2086/udp\nrtcm-sc104\t2101/tcp\t\t\t# RTCM SC-104 IANA 1/29/99\nrtcm-sc104\t2101/udp\ngsigatekeeper\t2119/tcp\ngsigatekeeper\t2119/udp\ngris\t\t2135/tcp\t\t# Grid Resource Information Server\ngris\t\t2135/udp\ncvspserver\t2401/tcp\t\t\t# CVS client/server operations\ncvspserver\t2401/udp\nvenus\t\t2430/tcp\t\t\t# codacon port\nvenus\t\t2430/udp\t\t\t# Venus callback/wbc interface\nvenus-se\t2431/tcp\t\t\t# tcp side effects\nvenus-se\t2431/udp\t\t\t# udp sftp side effect\ncodasrv\t\t2432/tcp\t\t\t# not used\ncodasrv\t\t2432/udp\t\t\t# server port\ncodasrv-se\t2433/tcp\t\t\t# tcp side effects\ncodasrv-se\t2433/udp\t\t\t# udp sftp side effect\nmon\t\t2583/tcp\t\t\t# MON traps\nmon\t\t2583/udp\ndict\t\t2628/tcp\t\t\t# Dictionary server\ndict\t\t2628/udp\nf5-globalsite\t2792/tcp\nf5-globalsite\t2792/udp\ngsiftp\t\t2811/tcp\ngsiftp\t\t2811/udp\ngpsd\t\t2947/tcp\ngpsd\t\t2947/udp\ngds-db\t\t3050/tcp\tgds_db\t\t# InterBase server\ngds-db\t\t3050/udp\tgds_db\ni"..., 4096) = 4096 15:28:30.082853 read(18, "qmaster\t6444/tcp\tsge_qmaster\t# Grid Engine Qmaster Service\nsge-qmaster\t6444/udp\tsge_qmaster\nsge-execd\t6445/tcp\tsge_execd\t# Grid Engine Execution Service\nsge-execd\t6445/udp\tsge_execd\nmysql-proxy\t6446/tcp\t\t\t# MySQL Proxy\nmysql-proxy\t6446/udp\nafs3-fileserver 7000/tcp\tbbs\t\t# file server itself\nafs3-fileserver 7000/udp\tbbs\nafs3-callback\t7001/tcp\t\t\t# callbacks to cache managers\nafs3-callback\t7001/udp\nafs3-prserver\t7002/tcp\t\t\t# users & groups database\nafs3-prserver\t7002/udp\nafs3-vlserver\t7003/tcp\t\t\t# volume location database\nafs3-vlserver\t7003/udp\nafs3-kaserver\t7004/tcp\t\t\t# AFS/Kerberos authentication\nafs3-kaserver\t7004/udp\nafs3-volser\t7005/tcp\t\t\t# volume managment server\nafs3-volser\t7005/udp\nafs3-errors\t7006/tcp\t\t\t# error interpretation service\nafs3-errors\t7006/udp\nafs3-bos\t7007/tcp\t\t\t# basic overseer process\nafs3-bos\t7007/udp\nafs3-update\t7008/tcp\t\t\t# server-to-server updater\nafs3-update\t7008/udp\nafs3-rmtsys\t7009/tcp\t\t\t# remote cache manager service\nafs3-rmtsys\t7009/udp\nfont-service\t7100/tcp\txfs\t\t# X Font Service\nfont-service\t7100/udp\txfs\nhttp-alt\t8080/tcp\twebcache\t# WWW caching service\nhttp-alt\t8080/udp\nbacula-dir\t9101/tcp\t\t\t# Bacula Director\nbacula-dir\t9101/udp\nbacula-fd\t9102/tcp\t\t\t# Bacula File Daemon\nbacula-fd\t9102/udp\nbacula-sd\t9103/tcp\t\t\t# Bacula Storage Daemon\nbacula-sd\t9103/udp\nxmms2\t\t9667/tcp\t# Cross-platform Music Multiplexing System\nxmms2\t\t9667/udp\nnbd\t\t10809/tcp\t\t\t# Linux Network Block Device\nzabbix-agent\t10050/tcp\t\t\t# Zabbix Agent\nzabbix-agent\t10050/udp\nzabbix-trapper\t10051/tcp\t\t\t# Zabbix Trapper\nzabbix-trapper\t10051/udp\namanda\t\t10080/tcp\t\t\t# amanda backup services\namanda\t\t10080/udp\ndicom\t\t11112/tcp\nhkp\t\t11371/tcp\t\t\t# OpenPGP HTTP Keyserver\nhkp\t\t11371/udp\nbprd\t\t13720/tcp\t\t\t# VERITAS NetBackup\nbprd\t\t13720/udp\nbpdbm\t\t13721/tcp\t\t\t# VERITAS NetBackup\nbpdbm\t\t13721/udp\nbpjava-msvc\t13722/tcp\t\t\t# BP Java MSVC Protocol\nbpjava-msvc\t13722/udp\nvnetd\t\t13724/tcp\t\t\t# Veritas Network Utility\nvnetd\t\t13724/udp\nbpcd\t\t13782/tcp\t\t\t# VERITAS NetBackup\nbpcd\t\t13782/udp\nvopied\t\t13783"..., 4096) = 4096 15:28:30.083085 read(18, "ion\nspamd\t\t783/tcp\t\t\t\t# spamassassin daemon\nomirr\t\t808/tcp\t\tomirrd\t\t# online mirror\nomirr\t\t808/udp\t\tomirrd\ncustoms\t\t1001/tcp\t\t\t# pmake customs server\ncustoms\t\t1001/udp\nskkserv\t\t1178/tcp\t\t\t# skk jisho server port\npredict\t\t1210/udp\t\t\t# predict -- satellite tracking\nrmtcfg\t\t1236/tcp\t\t\t# Gracilis Packeten remote config server\nwipld\t\t1300/tcp\t\t\t# Wipl network monitor\nxtel\t\t1313/tcp\t\t\t# french minitel\nxtelw\t\t1314/tcp\t\t\t# french minitel\nsupport\t\t1529/tcp\t\t\t# GNATS\ncfinger\t\t2003/tcp\t\t\t# GNU Finger\nfrox\t\t2121/tcp\t\t\t# frox: caching ftp proxy\nninstall\t2150/tcp\t\t\t# ninstall service\nninstall\t2150/udp\nzebrasrv\t2600/tcp\t\t\t# zebra service\nzebra\t\t2601/tcp\t\t\t# zebra vty\nripd\t\t2602/tcp\t\t\t# ripd vty (zebra)\nripngd\t\t2603/tcp\t\t\t# ripngd vty (zebra)\nospfd\t\t2604/tcp\t\t\t# ospfd vty (zebra)\nbgpd\t\t2605/tcp\t\t\t# bgpd vty (zebra)\nospf6d\t\t2606/tcp\t\t\t# ospf6d vty (zebra)\nospfapi\t\t2607/tcp\t\t\t# OSPF-API\nisisd\t\t2608/tcp\t\t\t# ISISd vty (zebra)\nafbackup\t2988/tcp\t\t\t# Afbackup system\nafbackup\t2988/udp\nafmbackup\t2989/tcp\t\t\t# Afmbackup system\nafmbackup\t2989/udp\nxtell\t\t4224/tcp\t\t\t# xtell server\nfax\t\t4557/tcp\t\t\t# FAX transmission service (old)\nhylafax\t\t4559/tcp\t\t\t# HylaFAX client-server protocol (new)\ndistmp3\t\t4600/tcp\t\t\t# distmp3host daemon\nmunin\t\t4949/tcp\tlrrd\t\t# Munin\nenbd-cstatd\t5051/tcp\t\t\t# ENBD client statd\nenbd-sstatd\t5052/tcp\t\t\t# ENBD server statd\npcrd\t\t5151/tcp\t\t\t# PCR-1000 Daemon\nnoclog\t\t5354/tcp\t\t\t# noclogd with TCP (nocol)\nnoclog\t\t5354/udp\t\t\t# noclogd with UDP (nocol)\nhostmon\t\t5355/tcp\t\t\t# hostmon uses TCP (nocol)\nhostmon\t\t5355/udp\t\t\t# hostmon uses UDP (nocol)\nrplay\t\t5555/udp\t\t\t# RPlay audio service\nnrpe\t\t5666/tcp\t\t\t# Nagios Remote Plugin Executor\nnsca\t\t5667/tcp\t\t\t# Nagios Agent - NSCA\nmrtd\t\t5674/tcp\t\t\t# MRT Routing Daemon\nbgpsim\t\t5675/tcp\t\t\t# MRT Routing Simulator\ncanna\t\t5680/tcp\t\t\t# cannaserver\nsyslog-tls\t6514/tcp\t\t\t# Syslog over TLS [RFC5425]\nsane-port\t6566/tcp\tsane saned\t# SANE network scanner daemon\nircd\t\t6667/tcp\t\t\t# Internet Relay Chat\nzope-ftp\t8021/tcp\t\t\t# zope management by ftp\ntproxy\t\t808"..., 4096) = 3174 15:28:30.083261 read(18, "", 4096) = 0 15:28:30.083362 close(18) = 0 15:28:30.083462 munmap(0x7f363a604000, 4096) = 0 15:28:30.083595 socket(PF_INET6, SOCK_STREAM, IPPROTO_TCP) = 18 15:28:30.083712 setsockopt(18, SOL_IPV6, IPV6_V6ONLY, [1], 4) = 0 15:28:30.083837 bind(18, {sa_family=AF_INET6, sin6_port=htons(0), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = 0 15:28:30.083953 listen(18, 128) = 0 15:28:30.084069 getpeername(18, 0x7fff405e3170, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:30.084181 getsockname(18, {sa_family=AF_INET6, sin6_port=htons(44688), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 0 15:28:30.084295 getsockopt(18, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:30.084406 getsockname(18, {sa_family=AF_INET6, sin6_port=htons(44688), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 0 15:28:30.084526 socket(PF_LOCAL, SOCK_STREAM, 0) = 19 15:28:30.084634 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.084747 getpeername(19, 0x7fff405e2fb0, [128]) = -1 ENOTCONN (Transport endpoint is not connected) 15:28:30.084855 connect(19, {sa_family=AF_LOCAL, sun_path="/var/run/rpcbind.sock"}, 23) = 0 15:28:30.085028 getsockname(19, {sa_family=AF_LOCAL, NULL}, [2]) = 0 15:28:30.085165 getsockopt(19, SOL_SOCKET, SO_TYPE, [1], [4]) = 0 15:28:30.085279 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.085400 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.085517 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.085645 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.085761 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.085877 geteuid() = 0 15:28:30.085978 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.086101 write(19, "\200\0\0P\22\265{T\0\0\0\0\0\0\0\2\0\1\206\240\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\206\245\0\0\0\3\0\0\0\4tcp6\0\0\0\n::.174.144\0\0\0\0\0\0010\0\0\0", 84) = 84 15:28:30.086238 poll([{fd=19, events=POLLIN}], 1, 60000) = 1 ([{fd=19, revents=POLLIN}]) 15:28:30.086372 read(19, "\200\0\0\34\22\265{T\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1", 9000) = 32 15:28:30.086488 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.086595 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0 15:28:30.086709 close(19) = 0 15:28:30.086837 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 15:28:30.087006 read(6, "", 4096) = 0 15:28:30.087119 close(6) = 0 15:28:30.087220 munmap(0x7f363a605000, 4096) = 0 15:28:30.087339 rt_sigaction(SIGINT, {0x404260, [], SA_RESTORER, 0x7f3639a00190}, NULL, 8) = 0 15:28:30.087448 rt_sigaction(SIGTERM, {0x404260, [], SA_RESTORER, 0x7f3639a00190}, NULL, 8) = 0 15:28:30.087556 rt_sigaction(SIGHUP, {0x404110, [], SA_RESTORER, 0x7f3639a00190}, NULL, 8) = 0 15:28:30.087676 open("/var/lib/nfs/etab", O_RDONLY) = 6 15:28:30.087808 fstat(6, {st_mode=S_IFREG|0644, st_size=198, ...}) = 0 15:28:30.087924 close(0) = 0 15:28:30.088169 open("/var/lib/nfs/.etab.lock", O_RDONLY|O_CREAT, 0600) = 0 15:28:30.088292 fcntl(0, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0 15:28:30.088416 open("/var/lib/nfs/etab", O_RDONLY) = 19 15:28:30.088566 fstat(19, {st_mode=S_IFREG|0644, st_size=198, ...}) = 0 15:28:30.088675 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f363a605000 15:28:30.088790 read(19, "/export\t10.0.0.0/24(rw,async,wdelay,hide,nocrossmnt,secure,no_root_squash,no_all_squash,no_subtree_check,secure_locks,acl,fsid=0,anonuid=65534,anongid=65534,sec=sys,rw,no_root_squash,no_all_squash)\n", 4096) = 198 15:28:30.088959 open("/proc/fs/nfsd/export_features", O_RDONLY) = 20 15:28:30.089079 read(20, "0x17e3f 0xf\n", 50) = 12 15:28:30.089191 close(20) = 0 15:28:30.089322 lstat("/export", {st_mode=S_IFDIR|0777, st_size=102, ...}) = 0 15:28:30.089473 read(19, "", 4096) = 0 15:28:30.089577 read(19, "", 4096) = 0 15:28:30.089681 close(19) = 0 15:28:30.089780 munmap(0x7f363a605000, 4096) = 0 15:28:30.089900 close(0) = 0 15:28:30.090017 open("/proc/net/rpc/auth.unix.ip/flush", O_RDWR) = 0 15:28:30.090180 write(0, "1407850110\n", 11) = 11 15:28:30.090298 close(0) = 0 15:28:30.090425 open("/proc/net/rpc/auth.unix.gid/flush", O_RDWR) = 0 15:28:30.090556 write(0, "1407850110\n", 11) = 11 15:28:30.090666 close(0) = 0 15:28:30.090769 open("/proc/net/rpc/nfsd.fh/flush", O_RDWR) = 0 15:28:30.090896 write(0, "1407850110\n", 11) = 11 15:28:30.091032 close(0) = 0 15:28:30.091137 open("/proc/net/rpc/nfsd.export/flush", O_RDWR) = 0 15:28:30.091261 write(0, "1407850110\n", 11) = 11 15:28:30.091369 close(0) = 0 15:28:30.091482 open("/var/lib/nfs/.xtab.lock", O_RDWR|O_CREAT, 0600) = 0 15:28:30.091596 fcntl(0, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0}) = 0 15:28:30.091708 open("/var/lib/nfs/xtab.tmp", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 19 15:28:30.091893 close(19) = 0 15:28:30.091995 open("/var/lib/nfs/xtab.tmp", O_RDONLY) = 19 15:28:30.092101 open("/var/lib/nfs/xtab", O_RDONLY) = 20 15:28:30.092211 read(19, "", 4096) = 0 15:28:30.092326 read(20, "", 4096) = 0 15:28:30.092429 close(19) = 0 15:28:30.092528 close(20) = 0 15:28:30.092628 unlink("/var/lib/nfs/xtab.tmp") = 0 15:28:30.092788 close(0) = 0 15:28:30.092896 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f363a5f6a90) = 4774 15:28:30.094035 exit_group(0) = ? 15:28:30.094576 +++ exited with 0 +++