openssh unix dev - Apr 2001 - Suspicious shadow listen port

# netstat -an  | grep LISTEN

tcp4       0      0  *.32785                *.*                    LISTEN
tcp4       0      0  130.238.4.133.22       *.*                    LISTEN

What in ?@# is 32785 ??

# lsof
...
sshd 11152    root 5u  IPv4 0x7003ded8 0t0    TCP *:32785 (LISTEN)
sshd 11152    root 6u  IPv4 0x7004ded8 0t0    TCP xxx.yyy.zzz.hhh:22 (LISTEN)
...

#cat /etc/sshd_config

Port 22
Protocol 2,1
ListenAddress xxx.yyy.zzz.hhh
ListenAddress xxx.yyy.zzz.XXX
....

OOPS, forgot to remove a old ListenAddress for a removed interface...
Did that and HUP-ed sshd

# lsof

...
sshd 11152 root 6u  IPv4 0x7004ded8 0t0 TCP xxx.yyy.zzz.hhh:22 (LISTEN)
...


That is, a Listen config line for a non-existing address gives a
shadow port on ((-1 & 0x7fff) - 22).

Rather spooky...


cheers,
Torbj?rn Wictorin, Uppsala univ.

On Tue, 10 Apr 2001 Torbjorn.Wictorin at its.uu.se wrote:
: # netstat -an  | grep LISTEN
:
: tcp4       0      0  *.32785                *.*                    LISTEN
: tcp4       0      0  130.238.4.133.22       *.*                    LISTEN
:
: What in ?@# is 32785 ??
:
: # lsof
: ...
: sshd 11152    root 5u  IPv4 0x7003ded8 0t0    TCP *:32785 (LISTEN)
: sshd 11152    root 6u  IPv4 0x7004ded8 0t0    TCP xxx.yyy.zzz.hhh:22 (LISTEN)

which platform is this?  i can't dup on hp-ux 11.  does it come back
when you re-add the bogus listenaddr?