Home / server / Questions / 183102
Accepted
Paul D'Ambra
Asked: 2010-09-22 01:12:46 +0800 CST

Port listed as close-combat in netstat

  • 772

Have just run netstat -A on my SQL Server and seen an established connection from one of our workstations on bmcw000340.domain:close-combat.

My google-fu is failing me and I can't find out what close-combat is... does anyone know?

windows-server-2003 netstat

3 Answers

  1. It looks to be TCP and UDP port 1944:

    http://www.iana.org/assignments/port-numbers

    • 2
  2. Best Answer

    The translation that is done there (from port numbers to service names) is done using a lookup in your services file /etc/services. A very quick glance will show that a lot of information in there is entirely obsolete, and that it doesn't necessarily correspond to what is actually running or used on your machine.

    If you want, you can change the service name in the services file to what your server is actually hosting there.

    Additionally, bear in mind that with source port randomization, the service name of the source port is completely irrelevant, because it is random. Normally the ports chosen are supposed to be above 32767, but I typically don't observe this to be the case.

    If you find the translation to be obfuscating rather than informative, simply specify the -n option to netstat; this will prevent lookup of both port numbers and rDNS. In theory, you could also trim irrelevant entries from /etc/services, though I wouldn't.

    On windows this works exactly the same, except that the file is located at %WINDIR%\System32\drivers\etc\services.

    • 2

  3. Believe close combat was a game, way back when, people used to think their bit of software was important enough to have its own port, and for that port to appear in named lists :) As joequerty says, its not going to be "close combat" - especially (its not 100% clear) if it's the source port which is generally irrelevant.

    • 1