Last friday started as any other friday. I went to the office, plugged in my laptop and logged into my Fedora 7 system. Open a shell, setup a couple of environment variables, launch postgresql and start programming in Django. What a wonderful job, isn’t it?
Well, it is until you get errors like this:
[lgs@portatil-lgs saludinnova]$ python manage.py runserver
Validating models...
0 errors found
Django version 0.97-pre-SVN-6670, using settings 'saludinnova.settings'
Development server is running at http://127.0.0.1:8000/
Quit the server with CONTROL-C.
Error: That port is already in use.
Wait, I run the exact same command yesterday at the end of my job day and it actually worked! I immediately thought about a virus since I swear I didn’t change the system in any way. Or maybe I did…
So first, I needed to know which program was using the Django sacred port: 8000. Of course I can run Django development server in another port. But that’s not the point. And it’s not fun!
But first let’s make sure something is listening in port 8000:
[root@portatil-lgs ~]# nmap -sT -O localhost
Starting Nmap 4.20 ( http://insecure.org ) at 2007-11-30 10:39 CET
Interesting ports on portatil-lgs (127.0.0.1):
Not shown: 1691 closed ports
PORT STATE SERVICE
22/tcp open ssh
25/tcp open smtp
111/tcp open rpcbind
631/tcp open ipp
5432/tcp open postgres
8000/tcp open http-alt
Device type: general purpose
Running: Linux 2.6.X
OS details: Linux 2.6.17.8 SMP (x86)
Uptime: 0.080 days (since Fri Nov 30 08:43:31 2007)
Network Distance: 0 hops
Right, http-alt, what’s that?
[root@portatil-lgs ~]# ps aux | grep http-alt
root 6045 0.0 0.0 4032 752 pts/0 S+ 10:40 0:00 grep http-alt
No process is called http-alt. No big surprise since it looks like a standard name not binded to a real application. Let’s check the well known services:
[root@portatil-lgs ~]# cat /etc/services | grep 8000
irdmi 8000/tcp # iRDMI
irdmi 8000/udp # iRDMI
mtl8000-matrix 8115/tcp # MTL8000 Matrix
mtl8000-matrix 8115/udp # MTL8000 Matrix
biimenu 18000/tcp # Beckman Instruments, Inc.
biimenu 18000/udp # Beckman Instruments, Inc.
nxlmd 28000/tcp # NX License Manager
nxlmd 28000/udp # NX License Manager
nimcontroller 48000/tcp # Nimbus Controller
nimcontroller 48000/udp # Nimbus Controller
Still no clue of what’s going on. Let’s try netstat:
[root@portatil-lgs ~]# netstat -anp | grep 8000
tcp 0 0 127.0.0.1:8000 0.0.0.0:* LISTEN 2333/nasd
Aha! I got you nasd daemon! Whatever you are.
[root@portatil-lgs ~]# which nasd
/usr/bin/nasd
[root@portatil-lgs ~]# rpm -qf /usr/bin/nasd
nas-1.9.1-2.fc7
[root@portatil-lgs ~]# yum remove nas
Dependencies Resolved
=============================================================================
Package Arch Version Repository Size
=============================================================================
Removing:
nas i386 1.9.1-2.fc7 installed 1.3 M
Removing for dependencies:
qt4-x11 i386 4.3.2-4.fc7 installed 16 M
skype i586 1.4.0.118-fc5 installed 15 M
Finally I see the guilty program: it was Skype (well, one of its dependencies, a sound server), which I installed on thursday night to speak with my sister, who lives in Slovaquia. So it looks like I actually changed my system but I really couldn’t think about this kind of side effects. Fortunately my box is full of tools to help my damaged brain repair this tiny little problems 
