Groups > linux.debian.user > #166260 > unrolled thread

What is cisco-sccp?

Started by	Gábor Hársfalvi <hgabi84@gmail.com>
First post	2016-04-03 15:40 +0200
Last post	2016-04-05 21:00 +0200
Articles	20 on this page of 21 — 12 participants

Back to article view | Back to linux.debian.user

  What is cisco-sccp? Gábor Hársfalvi <hgabi84@gmail.com> - 2016-04-03 15:40 +0200
    Re: What is cisco-sccp? Sven Hartge <sven@svenhartge.de> - 2016-04-03 16:00 +0200
      Re: What is cisco-sccp? Gábor Hársfalvi <hgabi84@gmail.com> - 2016-04-03 16:40 +0200
        Re: What is cisco-sccp? Sven Hartge <sven@svenhartge.de> - 2016-04-03 16:50 +0200
          Re: What is cisco-sccp? Gábor Hársfalvi <hgabi84@gmail.com> - 2016-04-03 17:00 +0200
            Re: What is cisco-sccp? Cindy-Sue Causey <butterflybytes@gmail.com> - 2016-04-03 17:50 +0200
        Re: What is cisco-sccp? Gábor Hársfalvi <hgabi84@gmail.com> - 2016-04-03 21:00 +0200
          Re: What is cisco-sccp? Erwan David <erwan@rail.eu.org> - 2016-04-03 21:10 +0200
            Re: What is cisco-sccp? Martin Smith <lists@rakupottery.org.uk> - 2016-04-03 21:30 +0200
          Re: What is cisco-sccp? Gábor Hársfalvi <hgabi84@gmail.com> - 2016-04-03 21:10 +0200
            Re: What is cisco-sccp? Andy Smith <andy@strugglers.net> - 2016-04-05 09:10 +0200
    Re: What is cisco-sccp? deloptes <deloptes@gmail.com> - 2016-04-04 20:50 +0200
      Re: What is cisco-sccp? Gábor Hársfalvi <hgabi84@gmail.com> - 2016-04-05 06:40 +0200
        Re: What is cisco-sccp? <tomas@tuxteam.de> - 2016-04-05 09:00 +0200
          Re: What is cisco-sccp? Gábor Hársfalvi <hgabi84@gmail.com> - 2016-04-05 18:50 +0200
            Re: What is cisco-sccp? Dan Ritter <dsr@randomstring.org> - 2016-04-05 19:30 +0200
        Re: What is cisco-sccp? anxiousmac@gmail.com - 2016-04-05 09:10 +0200
          RE: What is cisco-sccp? Verde Denim <tdldev@gmail.com> - 2016-04-05 14:20 +0200
            RE: What is cisco-sccp? deloptes <deloptes@gmail.com> - 2016-04-05 20:50 +0200
    Re: What is cisco-sccp? Lisi Reisz <lisi.reisz@gmail.com> - 2016-04-05 02:00 +0200
    Re: What is cisco-sccp? Lisi Reisz <lisi.reisz@gmail.com> - 2016-04-05 21:00 +0200

Page 1 of 2 [1] 2 Next page →

#166260 — What is cisco-sccp?

From	Gábor Hársfalvi <hgabi84@gmail.com>
Date	2016-04-03 15:40 +0200
Subject	What is cisco-sccp?
Message-ID	<rjQpX-3X1-5@gated-at.bofh.it>

[Multipart message — attachments visible in raw view] — view raw

Hi,

What is it - and why it is in Debian? What is it doing here?

Thanks for the answers!

[toc] | [next] | [standalone]

#166263

From	Sven Hartge <sven@svenhartge.de>
Date	2016-04-03 16:00 +0200
Message-ID	<rjQJk-44U-3@gated-at.bofh.it>
In reply to	#166260

Gábor Hársfalvi <hgabi84@gmail.com> wrote:

> What is it - and why it is in Debian? What is it doing here?

I don't see any packages named cisco-sccp and I can't find any packages
containing a file named cisco-sccp in Debian.

Grüße,
Sven.

-- 
Sigmentation fault. Core dumped.

[toc] | [prev] | [next] | [standalone]

#166266

From	Gábor Hársfalvi <hgabi84@gmail.com>
Date	2016-04-03 16:40 +0200
Message-ID	<rjRm1-4Lw-7@gated-at.bofh.it>
In reply to	#166263

[Multipart message — attachments visible in raw view] — view raw

Sorry - I mean it for that ->

2000/udp Cisco SCCP (Skinny)
<https://hu.wikipedia.org/w/index.php?title=Skinny_Client_Control_Protocol&action=edit&redlink=1>

2016-04-03 15:51 GMT+02:00 Sven Hartge <sven@svenhartge.de>:

> Gábor Hársfalvi <hgabi84@gmail.com> wrote:
>
> > What is it - and why it is in Debian? What is it doing here?
>
> I don't see any packages named cisco-sccp and I can't find any packages
> containing a file named cisco-sccp in Debian.
>
> Grüße,
> Sven.
>
> --
> Sigmentation fault. Core dumped.
>
>

[toc] | [prev] | [next] | [standalone]

#166268

From	Sven Hartge <sven@svenhartge.de>
Date	2016-04-03 16:50 +0200
Message-ID	<rjRvI-4QL-9@gated-at.bofh.it>
In reply to	#166266

Gábor Hársfalvi <hgabi84@gmail.com> wrote:

> Sorry - I mean it for that ->

> 2000/udp Cisco SCCP (Skinny)
> <https://hu.wikipedia.org/w/index.php?title=Skinny_Client_Control_Protocol&action=edit&redlink=1>

Use "netstat -lupn | grep :2000" as root to get the process listening on
UDP port 2000.

Grüße,
Sven.

-- 
Sigmentation fault. Core dumped.

[toc] | [prev] | [next] | [standalone]

#166269

From	Gábor Hársfalvi <hgabi84@gmail.com>
Date	2016-04-03 17:00 +0200
Message-ID	<rjRFo-4Uw-5@gated-at.bofh.it>
In reply to	#166268

[Multipart message — attachments visible in raw view] — view raw

After run that as root nothing message.

2016-04-03 16:43 GMT+02:00 Sven Hartge <sven@svenhartge.de>:

> Gábor Hársfalvi <hgabi84@gmail.com> wrote:
>
> > Sorry - I mean it for that ->
>
> > 2000/udp Cisco SCCP (Skinny)
> > <
> https://hu.wikipedia.org/w/index.php?title=Skinny_Client_Control_Protocol&action=edit&redlink=1
> >
>
> Use "netstat -lupn | grep :2000" as root to get the process listening on
> UDP port 2000.
>
> Grüße,
> Sven.
>
> --
> Sigmentation fault. Core dumped.
>
>

[toc] | [prev] | [next] | [standalone]

#166272

From	Cindy-Sue Causey <butterflybytes@gmail.com>
Date	2016-04-03 17:50 +0200
Message-ID	<rjSrM-5Aw-7@gated-at.bofh.it>
In reply to	#166269

On 4/3/16, Gábor Hársfalvi <hgabi84@gmail.com> wrote:
>
> 2016-04-03 16:43 GMT+02:00 Sven Hartge <sven@svenhartge.de>:
>
>> Gábor Hársfalvi <hgabi84@gmail.com> wrote:
>>
>> > Sorry - I mean it for that ->
>>
>> > 2000/udp Cisco SCCP (Skinny)
>> > <
>> https://hu.wikipedia.org/w/index.php?title=Skinny_Client_Control_Protocol&action=edit&redlink=1
>>
>> Use "netstat -lupn | grep :2000" as root to get the process listening on
>> UDP port 2000.
>
> After run that as root nothing message.

Cisco's own website has a page titled "TCP and UDP Ports Used by Cisco
CallManager 3.3":

http://www.cisco.com/c/en/us/support/docs/voice-unified-communications/unified-communications-manager-callmanager/43881-ccm-tcp-udp-ports.html

That's all I know about it. It was found via an Internet search on
keywords picked from this thread. Just hoping that lead sheds some
light on it or at least leads to something else on their website that
explains why you're seeing what you've found..

PS What I did see but don't know if I'm understanding correctly is
that CSSP / IP Phone reference on that Cisco page. A different quick
search without clicking on any pages shows multiple references to VOIP
and VOIP capable computers. Mentioning that in case that tickles any
memory of using that feature with something. :)

Cindy :)

-- 
Cindy-Sue Causey
Talking Rock, Pickens County, Georgia, USA

* runs with duct tape *

[toc] | [prev] | [next] | [standalone]

#166297

From	Gábor Hársfalvi <hgabi84@gmail.com>
Date	2016-04-03 21:00 +0200
Message-ID	<rjVpE-7JP-9@gated-at.bofh.it>
In reply to	#166266

[Multipart message — attachments visible in raw view] — view raw

"Is it from /etc/services ?" -> Yes its in there - but there aren't more
information about the program which use it :(

And I don't know how I close this port.

2016-04-03 17:47 GMT+02:00 Erwan David <erwan@rail.eu.org>:

> Le 03/04/2016 16:30, Gábor Hársfalvi a écrit :
> > Sorry - I mean it for that ->
> >
> > 2000/udp      Cisco SCCP (Skinny)
> > <
> https://hu.wikipedia.org/w/index.php?title=Skinny_Client_Control_Protocol&action=edit&redlink=1
> >
> >
> >
> >
> > 2016-04-03 15:51 GMT+02:00 Sven Hartge <sven@svenhartge.de
> > <mailto:sven@svenhartge.de>>:
> >
> >     Gábor Hársfalvi <hgabi84@gmail.com <mailto:hgabi84@gmail.com>>
> wrote:
> >
> >     > What is it - and why it is in Debian? What is it doing here?
> >
> >     I don't see any packages named cisco-sccp and I can't find any
> >     packages
> >     containing a file named cisco-sccp in Debian.
> >
> >     Grüße,
> >     Sven.
> >
> >     --
> >     Sigmentation fault. Core dumped.
> >
> >
> Is it from /etc/services ? Even if you have no program using the ports,
> the information is here, for whatever use you may have.
>

[toc] | [prev] | [next] | [standalone]

#166299

From	Erwan David <erwan@rail.eu.org>
Date	2016-04-03 21:10 +0200
Message-ID	<rjVzk-83s-15@gated-at.bofh.it>
In reply to	#166297

Le 03/04/2016 21:04, Gábor Hársfalvi a écrit :
> How could I know what program uses the port 2000?
>

you can use netstat or lsof -i:2000

But the fact the port is mentionned  in /etc/services does not mean at
all it is used.

[toc] | [prev] | [next] | [standalone]

#166304

From	Martin Smith <lists@rakupottery.org.uk>
Date	2016-04-03 21:30 +0200
Message-ID	<rjVSF-8av-1@gated-at.bofh.it>
In reply to	#166299

On 03/04/2016 20:06, Erwan David wrote:
> Le 03/04/2016 21:04, Gábor Hársfalvi a écrit :
>> How could I know what program uses the port 2000?
>>
> you can use netstat or lsof -i:2000
>
> But the fact the port is mentionned  in /etc/services does not mean at
> all it is used.
>
>
indeed, /etc/services lists just about everything that can run tcp or udp
and the appropriate port(s), but just because it is there does not mean
it is running...

-- 
Martin

[toc] | [prev] | [next] | [standalone]

#166300

From	Gábor Hársfalvi <hgabi84@gmail.com>
Date	2016-04-03 21:10 +0200
Message-ID	<rjVzk-83s-19@gated-at.bofh.it>
In reply to	#166297

[Multipart message — attachments visible in raw view] — view raw

How could I know what program uses the port 2000?

2016-04-03 20:56 GMT+02:00 Erwan David <erwan@rail.eu.org>:

> Le 03/04/2016 20:53, Gábor Hársfalvi a écrit :
> > "Is it from /etc/services ?" -> Yes its in there - but there aren't
> > more information about the program which use it :(
> >
> > And I don't know how I close this port.
> >
>
> /etc/services is just a static file putting a name on some ports. It
> does not mean the port is in use
> It may be used by some programs which allow you to designate a port by
> name rather than by number.
>
> No worry to have
>

[toc] | [prev] | [next] | [standalone]

#166397

From	Andy Smith <andy@strugglers.net>
Date	2016-04-05 09:10 +0200
Message-ID	<rkthE-7VO-9@gated-at.bofh.it>
In reply to	#166300

Hi Gábor,

On Sun, Apr 03, 2016 at 09:04:44PM +0200, Gábor Hársfalvi wrote:
> How could I know what program uses the port 2000?

You keep asking "how can I get rid of it?" and "how can I close it?"
and "why is it in Debian?" but you haven't yet shown us why you
think you have something related to cisco-sccp running on your
computer.

You say you did the netstat and/or lsof command suggested earlier.
Its lack of output suggests you have nothing listening on port 2000
TCP and so are not running cisco-ssp software. There's a few reasons
why that could give a false positive, but before we go there we need
to know what prompted you to ask these questions.

So, please be clear: what are you seeing that makes you think you
actually have something related to cisco-ssp running on your
computer?

Cheers,
Andy

-- 
http://bitfolk.com/ -- No-nonsense VPS hosting

[toc] | [prev] | [next] | [standalone]

#166382

From	deloptes <deloptes@gmail.com>
Date	2016-04-04 20:50 +0200
Message-ID	<rkhJw-7va-23@gated-at.bofh.it>
In reply to	#166260

Gábor Hársfalvi wrote:

> Hi,
> 
> What is it - and why it is in Debian? What is it doing here?
> 
> Thanks for the answers!

https://supportforums.cisco.com/document/86036/ip-phone-sccp-sip-phone-registration-process-cucm

so if you see this here

grep 2000 /etc/services
cisco-sccp      2000/tcp                        # Cisco SCCP
cisco-sccp      2000/udp

it just means it is reserved for that protocol. I would wonder if you have
any program running this unless you have hijacked a cisco phone. If you
have done so, it means your question is obsolete. If you have not done so,
it means your question is obsolete.

regards

[toc] | [prev] | [next] | [standalone]

#166392

From	Gábor Hársfalvi <hgabi84@gmail.com>
Date	2016-04-05 06:40 +0200
Message-ID	<rkqWu-5Yd-3@gated-at.bofh.it>
In reply to	#166382

[Multipart message — attachments visible in raw view] — view raw

Thanks for the answer.

grep 2000 /etc/services
cisco-sccp 2000/tcp # Cisco SCCP
cisco-sccp 2000/udp
I see that...

And I don't use any program with cisco phone - but I think I have the
program installed because of something else.

So how could I get rid of that?

How could I remove program which use that port and close port too?

Thanks

2016-04-04 20:47 GMT+02:00 deloptes <deloptes@gmail.com>:

> Gábor Hársfalvi wrote:
>
> > Hi,
> >
> > What is it - and why it is in Debian? What is it doing here?
> >
> > Thanks for the answers!
>
>
> https://supportforums.cisco.com/document/86036/ip-phone-sccp-sip-phone-registration-process-cucm
>
> so if you see this here
>
> grep 2000 /etc/services
> cisco-sccp      2000/tcp                        # Cisco SCCP
> cisco-sccp      2000/udp
>
> it just means it is reserved for that protocol. I would wonder if you have
> any program running this unless you have hijacked a cisco phone. If you
> have done so, it means your question is obsolete. If you have not done so,
> it means your question is obsolete.
>
> regards
>
>

[toc] | [prev] | [next] | [standalone]

#166395

From	<tomas@tuxteam.de>
Date	2016-04-05 09:00 +0200
Message-ID	<rkt7Y-7Bt-3@gated-at.bofh.it>
In reply to	#166392

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, Apr 05, 2016 at 06:36:14AM +0200, Gábor Hársfalvi wrote:
> Thanks for the answer.
> 
> grep 2000 /etc/services
> cisco-sccp 2000/tcp # Cisco SCCP
> cisco-sccp 2000/udp
> I see that...
> 
> And I don't use any program with cisco phone - but I think I have the
> program installed because of something else.
> 
> So how could I get rid of that?
> 
> How could I remove program which use that port and close port too?

How do you know the port is open?

regards
- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlcDWXwACgkQBcgs9XrR2kYvNwCeM11M9pKet901zSVo++77PMaw
DSEAn1lck/qpXf13UGXgPfflXWkHgHxf
=4KX2
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#166428

From	Gábor Hársfalvi <hgabi84@gmail.com>
Date	2016-04-05 18:50 +0200
Message-ID	<rkCkX-70h-11@gated-at.bofh.it>
In reply to	#166395

[Multipart message — attachments visible in raw view] — view raw

>From Zenmap - or something similar portscanner.

[toc] | [prev] | [next] | [standalone]

#166432

From	Dan Ritter <dsr@randomstring.org>
Date	2016-04-05 19:30 +0200
Message-ID	<rkCXF-7yp-27@gated-at.bofh.it>
In reply to	#166428

On Tue, Apr 05, 2016 at 06:45:17PM +0200, Gábor Hársfalvi wrote:
> >From Zenmap - or something similar portscanner.

Consider running:

# netstat -tulnp

which will, run as root, identify all the listening ports on
your system, UDP, TCP, IPv4 and IPv6, and -- special for root --
tell you the process name as well.

Anything that has a local address of 127.0.0.1 is only offering 
services to other processes on the same box.

Processes with a specific local address are listening only on 
that IP address -- this is mostly interesting if you have
several networks connected.

Most processes will be listening on every available IP address.

-dsr-

[toc] | [prev] | [next] | [standalone]

#166398

From	anxiousmac@gmail.com
Date	2016-04-05 09:10 +0200
Message-ID	<rkthE-7VO-13@gated-at.bofh.it>
In reply to	#166392

On Tuesday, 5 April 2016 05:40:05 UTC+1, Gábor Hársfalvi  wrote:
> Thanks for the answer.
> 
> 
> 
> grep 2000 /etc/services
> cisco-sccp	2000/tcp			# Cisco SCCP
> cisco-sccp	2000/udp
> 
> I see that...
> 

Just because you have a line in /etc/services, it does not mean you have a program installed.

See http://www.penguintutor.com/linux/network-services-ports

[toc] | [prev] | [next] | [standalone]

#166408

From	Verde Denim <tdldev@gmail.com>
Date	2016-04-05 14:20 +0200
Message-ID	<rky7E-3bC-19@gated-at.bofh.it>
In reply to	#166398

[Multipart message — attachments visible in raw view] — view raw

Sent from Mail for Windows 10

From: anxiousmac@gmail.com
Sent: Tuesday, April 5, 2016 3:06 AM
To: debian-user@lists.debian.org
Subject: Re: What is cisco-sccp?

On Tuesday, 5 April 2016 05:40:05 UTC+1, Gábor Hársfalvi  wrote:
> Thanks for the answer.
> 
> 
> 
> grep 2000 /etc/services
> cisco-sccp	2000/tcp			# Cisco SCCP
> cisco-sccp	2000/udp
> 
> I see that...
> 
>
>Just because you have a line in /etc/services, it does not mean you have a program installed.
>
>See http://www.penguintutor.com/linux/network-services-ports

Just to name-drop a reply – 
“The Skinny Client Control Protocol (SCCP) is a proprietary network terminal control protocol originally developed by Selsius Systems, which was acquired by Cisco Systems in 1998. SCCP is a lightweight IP-based protocol for session signaling with Cisco Unified Communications Manager, formerly named CallManager.”

Google and other sources can give you much more detail…

Sorry for the format. I haven’t started on the new box yet…


---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

[toc] | [prev] | [next] | [standalone]

#166437

From	deloptes <deloptes@gmail.com>
Date	2016-04-05 20:50 +0200
Message-ID	<rkEd3-8n1-13@gated-at.bofh.it>
In reply to	#166408

Verde Denim wrote:

> 
> Google and other sources can give you much more detail…
> 
> Sorry for the format. I haven’t started on the new box yet…
> 

He doesn't even understand what we write - this might be the root cause - in
case of google as well.

[toc] | [prev] | [next] | [standalone]

#166387

From	Lisi Reisz <lisi.reisz@gmail.com>
Date	2016-04-05 02:00 +0200
Message-ID	<rkmzy-2ph-49@gated-at.bofh.it>
In reply to	#166260

On Sunday 03 April 2016 14:34:38 Gábor Hársfalvi wrote:
> Hi,
>
> What is it 

https://www.google.co.uk/search?q=cisco-sccp&oq=cisco-sccp&aqs=chrome..69i57j69i60.1299j0j7&sourceid=chrome&ie=UTF-8

> - and why it is in Debian?  

It isn't.

https://packages.debian.org/search?keywords=cisco-sccp&searchon=names&suite=all&section=all

> What is it doing here? 

It isn't here.

Lisi

[toc] | [prev] | [next] | [standalone]

Page 1 of 2 [1] 2 Next page →

csiph-web

What is cisco-sccp?

Contents

#166260 — What is cisco-sccp?

#166263

#166266

#166268

#166269

#166272

#166297

#166299

#166304

#166300

#166397

#166382

#166392

#166395

#166428

#166432

#166398

#166408

#166437

#166387