Thanks Steve/Troy I needed the netstat -ap to find this: tcp 0 0 *:rwhois *:* LISTEN 3870/pmcd tcp 0 0 gridhost.ccc.cranfie:rwhois grid-fe-a.central.cra:39982 ESTABLISHED 3870/pmcd It is not in fact rwhois but the pmcd from pcp which is supplied with SAMBA ? which is responding on that well-known port. By disabling pcp and stopping pcmd we have now lost that open port. No doubt its a configurable option in a file somewhere. Thanks, I think we can close it for now though there is still the mystery port 824 which appears to be associated with rpc.statd tcp 0 0 *:824 *:* LISTEN 3186/rpc.statd tcp 0 0 gridhost.ccc.cranfield.:824 grid-fe-a.central.cra:43572 TIME_WAIT - According to RHEL docs the port should have been assigned by the portmapper & thus not be a fixed port. Les