dovecot - Mar 2011 - rkhunter alert dovecot using port 1984

Hi all,

Debian Lenny, dovecot 1.0.15

My rkhunter script has picked up dovecot using port 1984 temporarily.
When I run it now however, it is gone.

Warning: Network TCP port 1984 is being used by /usr/lib/dovecot/imap.
Possible rootkit: Fuckit Rootkit
Use the 'lsof -i' or 'netstat -an' command to check this.

Does dovecot use this port for any reason? anyone seen this before?

Regards,
Mark

On 8.3.2011, at 12.43, Mark Adams wrote:
> Warning: Network TCP port 1984 is being used by /usr/lib/dovecot/imap.
> Possible rootkit: Fuckit Rootkit
> Use the 'lsof -i' or 'netstat -an' command to check this.
> 
> Does dovecot use this port for any reason? anyone seen this before?
No & no.