Subject: AW: [vserver] rkhunter Warns: Hidden ports found:
From: Fiedler Roman <Roman.Fiedler@ait.ac.at>
Date: Thu, 24 Oct 2013 14:39:46 +0000

 Thu, 24 Oct 2013 14:39:46 +0000
> Von: Bendtsen, Jon [mailto:Jon.Bendtsen@laerdal.dk]
> 
> 
> On 24/10/2013, at 15.56, Fiedler Roman <Roman.Fiedler@ait.ac.at> wrote:
> 
> >> Von: Ghislain [mailto:gadnet@aqueos.com]
> >>
> >>> cd /etc/vserver; ls | while read name; do vserver "${name}" exec
> >> netstat -nlp; done Roman
> >>
> >> I think you meant :
> >>
> >> vsomething vserver -- --running -- exec netstat -nlp
> >
> > If I had known it, I should have meant that.
> 
> vsomething does not appear to work for me. But here are netstat output
>  ....

So it seems, that most of dedicates service ports are both in netstat output and rkhunter
output. The correlation for unassigned highports was quite bad, perhaps they were only
used temporarily for callbacks. To be sure, one could compare multiple rkhunter outputs
and check those highports occurring  in multiple rkhunter runs.