Hello everyone,
on a freshly installed openSUSE 42.2 system I get this strange output from “netstat -tulp”:
http://pasteboard.co/4AOE9eXyb.jpg
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 localhost:ipp *:* LISTEN 1373/cupsd
tcp 0 0 localhost:smtp *:* LISTEN 1509/master
tcp 0 0 *:xmsg *:* LISTEN 1731/kdeconnectd
udp 0 0 *:bootpc *:* 928/wickedd-dhcp4
udp 0 0 *:xmsg *:* 1731/kdeconnectd
udp 0 0 *:mdns *:* 822/avahi-daemon: r
udp 0 0 *:38806 *:* 822/avahi-daemon: r
Now I really wonder what this “xmsg” might be about. According to http://www.speedguide.net/port.php?port=1716 it is assigned to “America’s Army Massively multiplayer online role-playing game (MMORPG) (unofficial)” (needless to say that I didn’t install this game, I never even heard about it), which doesn’t sound very legitimate to me. It uses port 1716 (TCP and UDP), but “nc -l 1716” gives “Address already in use” as its output.
It belongs to the process with PID 1731 (kdeconnectd), so I first used “pstree -ap” to find out more about this process, which gave me the following result:
http://pasteboard.co/JWoDVxU40.jpg
├─kdeinit5,1677
│ ├─file.so,3552
│ ├─kdeconnectd,1731 -session 10117108a5ed000148857986700000017710000_1488585928_992025
│ │ ├─{QDBusConnection},1740
│ │ ├─{QXcbEventReader},1737
│ │ └─{Qt bearer threa},1741
Then I checked the environment for this process:
PID TTY STAT TIME COMMAND
1731 ? Sl 0:00 /usr/lib64/libexec/kdeconnectd -session 10117108a5ed000148857986700000017710000_1488585928_992025 XDG_VTNR=7 LESSKEY=/etc/lesskey.bin MANPATH=/usr/local/man:/usr/share/man NNTPSERVER=news XDG_SESSION_ID=2 HOSTNAME=linux-7x3r XKEYSYMDB=/usr/X11R6/lib/X11/XKeysymDB TERM=xterm SHELL=/bin/bash HOST=linux-7x3r HISTSIZE=1000 PROFILEREAD=true GTK2_RC_FILES=/etc/gtk-2.0/gtkrc:/home/suseuser/.gtkrc-2.0:/home/suseuser/.config/gtkrc-2.0 GS_LIB=/home/suseuser/.fonts MORE=-sl XSESSION_IS_UP=yes GTK_MODULES=canberra-gtk-module KDE_FULL_SESSION=true XDG_SESSION_CLASS=user USER=suseuser JRE_HOME=/usr/lib64/jvm/jre XDG_SESSION_PATH=/org/freedesktop/DisplayManager/Session1 XNLSPATH=/usr/share/X11/nls QT_AUTO_SCREEN_SCALE_FACTOR=0 XDG_SEAT_PATH=/org/freedesktop/DisplayManager/Seat0 HOSTTYPE=x86_64 QEMU_AUDIO_DRV=pa FROM_HEADER= CONFIG_SITE=/usr/share/site/x86_64-unknown-linux-gnu PAGER=less CSHEDIT=emacs XDG_CONFIG_DIRS=/etc/xdg MINICOM=-c on DESKTOP_SESSION=/usr/share/xsessions/plasma5 PATH=/home/suseuser/bin:/usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/games MAIL=/var/spool/mail/suseuser CPU=x86_64 QT_IM_MODULE=xim JAVA_BINDIR=/usr/lib64/jvm/jre/bin PWD=/home/suseuser XDG_SESSION_TYPE=x11 INPUTRC=/home/suseuser/.inputrc XMODIFIERS=@im=local JAVA_HOME=/usr/lib64/jvm/jre KDE_SESSION_UID=1000 LANG=de_DE.UTF-8 PYTHONSTARTUP=/etc/pythonstart SSH_ASKPASS=/usr/lib/ssh/ksshaskpass AUDIODRIVER=pulseaudio GPG_TTY=kein Terminal SHLVL=1 XDG_SEAT=seat0 HOME=/home/suseuser QT_SYSTEM_DIR=/usr/share/desktop-data KDE_SESSION_VERSION=5 OSTYPE=linux LESS_ADVANCED_PREPROCESSOR=no SDL_AUDIODRIVER=pulse ALSA_CONFIG_PATH=/etc/alsa-pulse.conf XCURSOR_THEME=breeze_cursors WINDOWMANAGER=/usr/bin/startkde LOGNAME=suseuser XDG_SESSION_DESKTOP=KDE MACHTYPE=x86_64-suse-linux LESS=-M -I -R G_FILENAME_ENCODING=@locale,UTF-8,ISO-8859-15,CP1252 XDG_DATA_DIRS=/usr/share DBUS_SESSION_BUS_ADDRESS=unix:abstract=/tmp/dbus-9Zh5lcABNi,guid=7f5f06ecaf5a81a482c4933e58c9efa4 LESSOPEN=lessopen.sh %s DISPLAY=:0 XDG_RUNTIME_DIR=/run/user/1000 GTK_IM_MODULE=cedilla XAUTHLOCALHOSTNAME=linux-7x3r XDG_CURRENT_DESKTOP=KDE LESSCLOSE=lessclose.sh %s %s QT_IM_SWITCHER=imsw-multi G_BROKEN_FILENAMES=1 XAUTHORITY=/tmp/xauth-1000-_0 COLORTERM=1 JAVA_ROOT=/usr/lib64/jvm/jre _=/usr/lib64/libexec/kf5/start_kdeinit_wrapper KDE_MULTIHEAD=false GTK_RC_FILES=/etc/gtk/gtkrc:/home/suseuser/.gtkrc:/home/suseuser/.config/gtkrc SESSION_MANAGER=local/linux-7x3r:@/tmp/.ICE-unix/1714,unix/linux-7x3r:/tmp/.ICE-unix/1714
And then I checked which file handles are being used by it:
http://pastebin.com/29zsVgLP](http://pastebin.com/29zsVgLP)
I didn’t notice much suspicious there, except maybe these entries:
kdeconnec 1731 suseuser mem REG 0,20 217032 15900 /run/nscd/passwd
kdeconnec 1731 suseuser 3u unix 0xffff8802fc6e9c00 0t0 21090 type=STREAM
kdeconnec 1731 suseuser 4u a_inode 0,11 0 8172 [eventfd]
kdeconnec 1731 suseuser 5u a_inode 0,11 0 8172 [eventfd]
kdeconnec 1731 suseuser 6u unix 0xffff8803114c5c00 0t0 21091 type=STREAM
kdeconnec 1731 suseuser 7u a_inode 0,11 0 8172 [eventfd]
kdeconnec 1731 suseuser 8u unix 0xffff8802fd297800 0t0 21094 type=STREAM
kdeconnec 1731 suseuser 9u a_inode 0,11 0 8172 [eventfd]
kdeconnec 1731 suseuser 10u unix 0xffff8800d7dda800 0t0 19092 type=STREAM
kdeconnec 1731 suseuser 11u IPv4 22129 0t0 UDP *:xmsg
kdeconnec 1731 suseuser 12u IPv4 22131 0t0 TCP *:xmsg (LISTEN)
The files in /run/nscd are all binary format, but some stuff is readable, so I’ve created a .tar archive from the directory and uploaded it on my GoogleDrive, where anyone can download it from:
https://drive.google.com/file/d/0B62Y5Qk_rdbWaGNmUkpWN1BDaDA/view?usp=sharing
When I searched for “/run/nscd” and “xmsg”, Google returned only three results, one of these being this site, which I don’t really know what it’s about, but it gives me a very ‘obscure’ impression:
http://worshipleader.com/wp-includes/SimplePie/ac/root/scripts/upcp.static
What do other people think about this? Did anyone ever get this netstat output on a freshly installed system? What is the relationship between kdeconnectd (a normal program) and this strange protocol?
And does anyone have an idea how I could proceed to find out more about this?
Thanks in advance and kind regards