how to know more about the services (sometimes-rpc3,ppp...) that are running on server box

dear team,

i woluld like to stop all the services  those are unknowingly running on my AIX box.  when I start investigating i found  services  sometimes-rpc3  and ppp  ...two services that are running on these , those I dont have idea

please advise what is significance of these services and how to know which process/users are using these deamons
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Hanno P.S.IT Consultant and Infrastructure ArchitectCommented:
Talking about "services", I think you mean daemons (that's how they called
in Unix) whereas "services" is the windows term.

# netstat -a
show all (network) service ports on which daemons are listening for requests.

The name for the service port can be found in /etc/services.

Here is an example for a system with an active IMAP server, awaiting requests.
As the imap prcess itself will not be running all the time but will be started from
inetd (the "inet daemon") when requests arrive, you will not find a running
process for this service port.

# netstat -a | grep imap
tcp        0      0 *:imap2                 *:*                     LISTEN
# grep imap2 /etc/services
imap2           143/tcp         imap            # Interim Mail Access Proto v2
imap2           143/udp         imap

Open in new window


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
mansur_mcaAuthor Commented:
thanks for the quick reply.this inputs given me good info.

my intention stop all the services that are utilizing by any kind of request either by the server or from the users.

below list of services that I found on my server - that  have some assinged ports for it

sometimes-rpc3,  sometimes-rpc9, sometimes-rpc27  and PPP.

Could any one of them have idea ,what are these services for ??   where these will be used for ??.
these are on server that hosted currently with production database   and other oracle  application server.

thanks all in advance ...
Hanno P.S.IT Consultant and Infrastructure ArchitectCommented:
a) RPC is "remote procedure call". This looks like some non-standard (self-developed?) programs
b) PPP is then "point to point protocol", usually used for dialing into other systems via serial lines or modems
ON-DEMAND: 10 Easy Ways to Lose a Password

Learn about the methods that hackers use to lift real, working credentials from even the most security-savvy employees in this on-demand webinar. We cover the importance of multi-factor authentication and how these solutions can better protect your business!

mansur_mcaAuthor Commented:
is oracle application server  or database use these process  internally. ? how to crossvarify ?

is there any way to look  that any session call, using these services?

- thanks for all
Hanno P.S.IT Consultant and Infrastructure ArchitectCommented:
It's quite possible that oracle is using these ports.

Have you checked if there is any info (comment) in /etc/services about these?

Finally, the only chance to really verify would be to shut down iAS and see if they disappear ...
mansur_mcaAuthor Commented:

Thanks for the reply.

As you said ,good way to gaze services for ,whether these belongs to oracle/apps server, can be done by complete shutting the db/apps server.

As explained above I want to drill at

-       when the application server/db server up and running ,how to check whether any user session using these services ?
-      Or any other process that are depending on these services for its run.

Appreciate , for your kind reply
Hanno P.S.IT Consultant and Infrastructure ArchitectCommented:
If you want to know which sessions (and which user using it) are open, you will have to look into Oracle's network session display. I'm pretty much sure this would be some SQL*Net session.
Check the status of your "tnslnsr" and which sessions it handles.

But this is another question: Look into Oracle specifics, please
mansur_mcaAuthor Commented:
I  am very sorry , If you have misunderstood  my question.

I am looking at generic information , not perticuler kind of services what I explained above.  

-  how to know details about which user session or any process are  accessing  perticuler  services that are currently runnning on the server ?

hope this will be clear you
Hanno P.S.IT Consultant and Infrastructure ArchitectCommented:
In this case, you will have to obtain a program to check which
processes do have a certain port open.
This can be done with "lsof" which is a public domain tool.

Also, you may want to use some network sniffer (ethereal,
snoop and the like) to monitor network traffic for certain
rpcinfo -p
mansur_mcaAuthor Commented:
dear justUNIX ,  thanks for reply .

but the above command also not providing adequate info ,what info i am looking for( process/applications/session acccessing on this port).

any advice further ...
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
OS Security

From novice to tech pro — start learning today.