Unknown Listening UDP Port

[aque]

Hello,

I am running Healthchecks under Python 3.11 virtualenv with uWSGI and Nginx. The web app runs fine, but I noticed it is listening on a seemingly random UDP port. I could not find this in the documentation, and wondered if this is a security issue or normal. The port does not open immediately on boot but it starts up after some time elapsed.

Here is what I found so far.

$ sudo ss -lnup
State           Recv-Q           Send-Q                     Local Address:Port                      Peer Address:Port          Process          
UNCONN          2560             0                                0.0.0.0:51242                          0.0.0.0:*              users:(("python3",pid=530,fd=3))

$ sudo nmap -sU -p51242 n.n.n.n
Starting Nmap 7.94 ( https://nmap.org ) at 2024-03-17 01:38 CDT
Nmap scan report for server.domain.tld (n.n.n.n)
Host is up (0.066s latency).

PORT      STATE         SERVICE
51242/udp open|filtered unknown

Nmap done: 1 IP address (1 host up) scanned in 0.84 seconds

$ sudo ls -l /proc/530/fd
total 0
lr-x------ 1 www-healthchecks www-data 64 Mar 16 11:47 0 -> /dev/null
lrwx------ 1 www-healthchecks www-data 64 Mar 16 11:47 1 -> 'socket:[14889]'
lrwx------ 1 www-healthchecks www-data 64 Mar 16 11:47 2 -> 'socket:[14889]'
lrwx------ 1 www-healthchecks www-data 64 Mar 16 11:43 3 -> 'socket:[15652]'
lrwx------ 1 www-healthchecks www-data 64 Mar 16 11:43 4 -> 'socket:[15660]'

$ sudo lsof -p530 -n
COMMAND PID             USER   FD   TYPE             DEVICE SIZE/OFF   NODE NAME                                                                
python3 530 www-healthchecks  cwd    DIR              254,1     4096      2 /                                            
python3 530 www-healthchecks  rtd    DIR              254,1     4096      2 /                                                                   
python3 530 www-healthchecks  txt    REG              254,1  6831704  18504 /usr/bin/python3.11                         
python3 530 www-healthchecks  mem    REG              254,1  1437848  18851 /usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6                       

[snip]

python3 530 www-healthchecks    0r   CHR                1,3      0t0      4 /dev/null                                                           
python3 530 www-healthchecks    1u  unix 0x0000000038b29001      0t0  14889 type=STREAM (CONNECTED)                                             
python3 530 www-healthchecks    2u  unix 0x0000000038b29001      0t0  14889 type=STREAM (CONNECTED)                                             
python3 530 www-healthchecks    3u  IPv4              15652      0t0    UDP *:51242                                                             
python3 530 www-healthchecks    4u  IPv4              15660      0t0    TCP n.n.n.n:55158->n.n.n.n:mysql (ESTABLISHED)            

$ sudo ps -p530 w                                                                                                                
    PID TTY      STAT   TIME COMMAND                                                                                                            
    530 ?        Ss     1:53 /usr/local/libexec/healthchecks/bin/python3 -u /usr/local/src/healthchecks/manage.py sendalerts --no-threads

[cuu508]

I think this is the UPD socket for submitting statsd metrics.

I can reproduce the same thing locally:

• I runs manage.py sendalerts, netstat does not show an open UDP socket yet
• I trigger an up or down connection
• sendalerts sends an alert
• netstat now shows an open UDP socket belonging to the sendalerts process

If I then comment out these two lines and repeat the experiment, I don't see the open UDP socket.

[aque]

I'm glad you were able to reproduce @cuu508. Commenting out those two lines also got the same result. Thanks for the quick response and solution!

[cuu508]

I just pushed a change which makes statsd metric collection optional and off by default. To enable it, the operator must set STATSD_HOST env var.