Unknown ports

Hello,

After beginning to learn about security, I ran the following command netstat -tap grep LISTEN on a debian sarge system. It came up with the following lines, shortened to fit in the post:

tcp 0 0 *:32768 *:* LISTEN - tcp 0 0 *:2049 *:* LISTEN - tcp 0 0 *:dict *:* LISTEN 1725-0 tcp 0 0 *:870 *:* LISTEN 1960-rpc.statd tcp 0 0 *:sunrpc *:* LISTEN 1524-portmap tcp 0 0 *:auth *:* LISTEN 1758-oidentd tcp 0 0 *:659 *:* LISTEN 1752-rpc.mountd tcp 0 0 *:2710 *:* LISTEN 1987-upsd tcp 0 0 *:ssh *:* LISTEN 1838-sshd tcp 0 0 *:ipp *:* LISTEN 2912-cupsd tcp 0 0 *:postgresql *:* LISTEN 1817-postmaster

I don't understand the top two lines. I then ran lsof grep LISTEN and found the same files listed in the bottom 9 above but not the top two. Finally I ran nmap -v localhost with the following results:

PORT STATE SERVICE 22-tcp open ssh 111-tcp open rpcbind 113-tcp open auth 631-tcp open ipp 659-tcp open unknown 870-tcp open unknown 2049-tcp open nfs 2628-tcp open dict 5432-tcp open postgres

So apparently there are two ports listening that have no process or file buttociated with them. Nmap shows something for one of them, except that I am not sure what it is. And there is still the problem with port 32768: how can it be listening when closed? This is the first time I have seen anything peculiar with the computer, so I wonder if it has been hacked. The system is a simple home network with a dialup connection infrequently used. I did run chkrootkit, and it found nothing wrong except for a known false positive with dhcpd. I also have pbuttwords which may be crackable but not easily.

All this has convinced me of the need for a firewall, even with a dialup connection, and it is my next project.

My data is backed up, and I can reinstall the system if necessary. But I would hate to do so and find nothing wrong after all and these same lines appearing again. So I would be grateful if someone can either straighten me out or point in the right direction.

Thanks in advance for any enlightenment.

-- Bob Parnes