Thanks Steve/Troy

I needed the netstat -ap to find this:

tcp        0      0 *:rwhois                    
*:*                         LISTEN      3870/pmcd
tcp        0      0 gridhost.ccc.cranfie:rwhois 
grid-fe-a.central.cra:39982 ESTABLISHED 3870/pmcd

It is not in fact rwhois but the pmcd from pcp which is supplied with 
SAMBA ? which is responding on that well-known port.

By disabling pcp and stopping pcmd we have now lost that open port. No 
doubt its a configurable option in a file somewhere.

Thanks, I think we can close it for now though there is still the 
mystery port 824 which appears to be associated with rpc.statd

tcp        0      0 *:824                       
*:*                         LISTEN      3186/rpc.statd
tcp        0      0 gridhost.ccc.cranfield.:824 
grid-fe-a.central.cra:43572 TIME_WAIT   -

According to RHEL docs the port should have been assigned by the 
portmapper & thus not be a fixed port.

Les