port 8082 on ubuntu 9.10

When I nmap my computer I get this port open with this text

8082/tcp open blackice-alerts

Do anyone of you know what this blackice-alerts is

netstat reveal this

Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 @asad-linux-deskt:mysql *:* LISTEN tcp 0 0 *:8082 *:* LISTEN tcp 0 0 @asad-linux-desktop:ipp *:* LISTEN tcp 0 0 @asad-linux-deskt:43676 *:* LISTEN tcp 0 0 asad-linux-deskto:38148 hkg01s01-in-f113.1e:www ESTABLISHED tcp 0 0 asad-linux-deskto:34919 tx-in-f101.1e100.ne:www ESTABLISHED tcp 0 0 asad-linux-deskto:54513 hkg01s01-in-f102.1e:www ESTABLISHED tcp 0 0 asad-linux-deskto:55928 a88-221-217-18.depl:www ESTABLISHED tcp 1 0 @asad-linux-deskt:38277 @asad-linux-deskt:43676 CLOSE_WAIT tcp 0 0 asad-linux-deskto:51560 sin01s01-in-f104.1e:www ESTABLISHED tcp 0 0 asad-linux-deskto:51561 sin01s01-in-f104.1e:www ESTABLISHED tcp 0 0 asad-linux-deskto:53386 ec2-174-129-241-1:https ESTABLISHED tcp 0 0 asad-linux-deskto:55927 a88-221-217-18.depl:www ESTABLISHED tcp 1 0 @asad-linux-deskt:38270 @asad-linux-deskt:43676 CLOSE_WAIT tcp 0 0 asad-linux-deskto:41855 Asads-MacBook.loca:5900 ESTABLISHED tcp6 0 0 [::]:netbios-ssn [::]:* LISTEN tcp6 0 0 [::]:5900 [::]:* LISTEN tcp6 0 0 [::]:www [::]:* LISTEN tcp6 0 0 ip6-localhost:ipp [::]:* LISTEN tcp6 0 0 [::]:microsoft-ds [::]:* LISTEN udp 0 0 *:59554 *:* udp 0 0 *:bootpc *:* udp 0 0 *:mdns *:* udp 0 0 asad-linux-d:netbios-ns *:* udp 0 0 *:netbios-ns *:* udp 0 0 asad-linux-:netbios-dgm *:* udp 0 0 *:netbios-dgm *:* 

Any ideas .......?

3 Answers

Are you sure that's what is listening on 8082, rather than what nmap is guessing? Try:

 sudo lsof -i tcp:8082 

Ubuntu has a "policy" of not having any ports open for security purposes. On a LiveCD of Ubuntu 9.10, I don't see port 8082 open, so something you installed started a service on this port. To find out what has it open, run netstat with the -p flag with sudo:

sudo netstat -plant 

The last column will show a PID and a programs process name. You can find more detail about the running process by the PID listed from the output with:

sudo lsof -p:PID 

(Where PID is the number)

You can find out what package installed that program with dpkg -S

dpkg -S 

I had a web-proxy (webscarab) running on localhost and that was running on 8082. Netstat showed a java process (I guess webscarab is written in java and hence jvm is being invoked).

Closing Webscarab closed the port too.