说明：
一般为了inux主机性能、以及减少些隐患，我们都会尽可能把一些不需要的端口关闭或取消掉。但我们要怎么确定这些端口属于哪些服务呢？
具体：
1. 首先来看下目前哪些端口是开放的
# nmap 127.0.0.1 Starting nmap 3.70 ( http://www.insecure.org/nmap/ ) at 2007-12-05 21:28 CST Interesting ports on localhost.localdomain (127.0.0.1): (The 1652 ports scanned but not shown below are in state: closed) PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 25/tcp open smtp 80/tcp open http 766/tcp open unknown 3306/tcp open mysql 8009/tcp open ajp13 8080/tcp open http-proxy Nmap run completed -- 1 IP address (1 host up) scanned in 0.194 seconds
可以看到 766 端口是打开着的，一个 unknown 的服务正在运行，这是什么服务？
2. 可以看到有下面一条内容，说明是 rpc.statd 正在运行。
# netstat -lp tcp 0 0 *:766 *:* LISTEN 3128/rpc.statd 查看766端口是什么命令的另外一个办法 # lsof -i:766 COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME rpc.statd 3128 rpcuser 8u IPv4 6467 TCP *:766 (LISTEN)
3. 查看rpc.statd这个命令是那个安装包的文档，/sbin/rpc.statd是通过which rpc.statd查找出来的
# rpm -qf /sbin/rpc.statd nfs-utils-1.0.6-80.EL4
4. 查看nfs开头有那些东东
# ls /etc/init.d/nfs* /etc/init.d/nfs /etc/init.d/nfslock
5. 查看nfslock状态
# /etc/init.d/nfslock status rpc.statd (pid 3128) 正在运行...
6. 关闭nfslock服务，关闭nfslock开机启动
# /etc/init.d/nfslock stop # chkconfig nfslock off
7. 此时再查看766端口的服务，就可以看到已经关闭了
# nmap 127.0.0.1 Starting nmap 3.70 ( http://www.insecure.org/nmap/ ) at 2007-12-05 21:55 CST Interesting ports on localhost.localdomain (127.0.0.1): (The 1653 ports scanned but not shown below are in state: closed) PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 25/tcp open smtp 80/tcp open http 3306/tcp open mysql 8009/tcp open ajp13 8080/tcp open http-proxy Nmap run completed -- 1 IP address (1 host up) scanned in 0.194 seconds