Commplex listening on port 5000?

[46and2]

When I do a port scan or netstat -a | grep LISTEN, I get something listening on port 5000. Netstat calls it "commplex". Even if I turn on the firewall, it's still listening. It only listens on my IP address, not on 127.0.0.1. I am not running any servers that I know of, and no chat/IM clients. I can add the output of "ps aux" if needed. Can anyone tell me what it is and how to stop it?

 

[superbovine]

hmm

i have had the same question.

check out my nmaps without the firewall on.

superbovine:cow /etc $ nmap 192.168.1.101

Starting nmap 3.81 ( http://www.insecure.org/nmap/ ) at 2005-08-27 17:06 CDT
Interesting ports on 192.168.1.101:
(The 1660 ports scanned but not shown below are in state: closed)
PORT     STATE SERVICE
427/tcp  open  svrloc
5000/tcp open  UPnP
5001/tcp open  commplex-link #this port if for bonjour ichat

Nmap finished: 1 IP address (1 host up) scanned in 12.681 seconds
superbovine:cow /etc $ nmap localhost

Starting nmap 3.81 ( http://www.insecure.org/nmap/ ) at 2005-08-27 17:07 CDT
Interesting ports on localhost (127.0.0.1):
(The 1660 ports scanned but not shown below are in state: closed)
PORT     STATE SERVICE
427/tcp  open  svrloc
631/tcp  open  ipp
1033/tcp open  netinfo

Nmap finished: 1 IP address (1 host up) scanned in 14.109 seconds
superbovine:cow /etc $

 

[rich*e]

It's part of Bonjour

I have no clue what Bonjour is as I'm a little too lazy to really do some research, but it has something to do with making networking easier.

Here's what I did, use the netstat command:
$ netstat -an | grep -i listen
tcp4 0 0 192.168.1.100.5000 *.* LISTEN
tcp4 0 0 127.0.0.1.1033 *.* LISTEN

$ sudo lsof -i @192.168.1.100:5000
Password:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
mDNSRespo 40 root 13u IPv4 0x02be4c70 0t0 TCP 192.168.1.100:commplex-main (LISTEN)

man the lsof page if you have any questions on its use. Newsforge has a pretty decent beginners article on it too, too lazy to post the link tho.

rich*e

 

[superbovine]

from your post sounds a bit like upnp which is on port 5000

 

[belvdr]

It's part of the multicast DNS responder, which is is how Bonjour/Rendezvous works.