Got a weird situation brewing here.. I have four (4) Slackware 7.1 machines (kernels 2.2.16 & 2.4.0-test7). Running nmap on the localhost of each machine shows that there is some service listening on a port in the 6XX range on each machine: Machine #1 (home) port 666 machine #2 (home) port 664 machine #3 (work-desktop) port 678 machine #4 (work-backroom) port 680 Machine #2 has traditionally been on my LAN at home, with telnet, web and ftp open to the internet, via NAT on my Cicso 675. Machine #1 is an exact, recent (1 day old) copy of machine #2 (except for a few different hardware options in the kernel). Machines #3 and #4 are at work behind a corporate firewall, with no direct inbound access to either machine from the internet. AFAIK, #3 & #4 are unreachable inbound from the internet. All of these machines are very stock - no new services installed, save perhaps SSH on machine #1 & #2. For those of you prone to freaking out, web, ftp & telnet are now disabled on these machines. I now have info from other Slack 7.1 users on the forum, that *their* boxes are also listening on a port in the 6XX range, every one on a different port. At least one of these other boxes is a standalone unit, that has *never* seen a network connection period. When I initially saw this on my machines at home, I thought "sweet, you're rooted dipstick!", but the machines at work should be impossible to root (no internet access, and nobody here but me knows boo about *nix, so rule out an inside job), and the standalone box example also casts doubt on any rooting. When I try to telnet to the mystery listening port, I can connect, but two or three lines of input, and I get disconnected. Never any feedback. I'm pretty much out of ideas on this one. Help, anyone? -- Bill Layer Sales Technician <b.layer at vikingelectronics.com>