1

I have a 17" mid 2010 MBP with 8GB ram.

After reading up on some of the latest vulnerabilities, I did a port scan and found port 21 OPEN vs stealth for all other ports. I cannot figure out what is using port 21, but Activity Monitor shows ports 21 and 24 being used by mdflagwriter (see attached screen shot)

Why would a Spotlight indexing system be using these ports, and how do I close port 21? The other two show as stealth, but 21 seems to be open. Is it safe to just kill these pids?

Stealth mode is enabled in System Preferences->Security & Privacy.

Thanks for any answers. enter image description here

Improve this question
4
  • FWIW Apple says they use port 21 for FTP control. support.apple.com/kb/HT6175
    – grg ♦
    Commented Aug 28, 2014 at 10:27
  • Thanks George...I actually saw that table before posting, but was looking for another port at the time. ;) But why would the port be OPEN, and not stealth in a scan? That makes no sense. Interestingly, it does NOT say Apple uses port 24, which according to Activity Monitor, mdflagwriter is also using. I am a bit concerned that I may have some sort of mischief going on. I killed the pid for 21, with no noticeable effect so far. I think I will do the same for the on for port 24, just to be sure, then look to see if they open back up again. Again, thanks for the response.
    – user89000
    Commented Aug 28, 2014 at 12:47
  • It does seem strange—port 21 is open on my machine for FTP reasons as Apple says, but 24 is not. Also here's a related question about mdflagwriter: apple.stackexchange.com/q/143002
    – grg ♦
    Commented Aug 28, 2014 at 13:52
  • Heh, I saw that one before posting too. I did try to find info before posting, but it does not seem to be documented. I killed the port 24 pid, and it was back within 5 minutes. The strange thing is it bounces between port 24 and 25. 21 did not come back, but it was root and not me, so we will see what happens when I restart. At least 24 and 25 show up as stealth on a port scan. Still trying to figure out what this has to do with Spotlight indexing. :( Thanks again for trying to help.
    – user89000
    Commented Aug 28, 2014 at 16:54

1 Answer 1

Reset to default
1

The word "Ports" here does not mean what you think it means. It is not the number of a single TCP or UDP port the process has open. It is not even the count of such ports.

'The "ports" column shows how many "Mach ports", or "kernel queues" the process has open, which basically describes how communicative the process can be with others (eg: reserving memory usage from the system). This information will only be useful to system administrators and programmers.'

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .