> When I find something open and check > it again, it is closed. And... cannot > close "syslogd" for report issues. At least, can not you run syslogd with syslogd_flags="-ss" in /etc/rc.conf ? It disables listening on 514 at all, but still works locally. Do not use it, if your machine is used as syslogd "file server" for other machines ! And what about some milter ? It could open some local connections on high ports. Do not you have some kind of antispam system on your machine ? Or DansGuardian or something like ? Have you tried to run "sockstat >> /some/file" every minute from cron and try to find which process opens the port ? Peter Rosa _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "[email protected]"