Thanx all for reply. > Got BIND running? BIND usually likes to have a random TCP port bound. Mine > seems to be inclined to hang around in the 3xxx range, though. No, I don't have it. > nmap itself? Why only in userland? X? Could be my old and cheap comp. BTW, 3.48. > what does sockstat -p <portnumber> tell you? port 25 (ipfw2 dynamic rules) port 2628 dictd (server for dictionaries) port 514 syslogd in udp (no rule to access from outside) > Ftp perhaps? No, just a workstation. When I find something open and check it again, it is closed. And... cannot close "syslogd" for report issues. Is it what everyone have open on udp 514? Nothing suspected in conf. Best regards. ZK _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "[email protected]"