Hi,
You may try to see if is any data trafic trough that port with tcpdump -vv -i intern_interface port 914.
Anyway ... try to block it with iptables just to be sure and follow Pavel's advice in order to determine wich pid/user/command has opened that port.
Best regards,
Ah, fuser and tcpdump were the missing pieces of the puzzle! rpc.rquotad was the culprit. Thank you all for your help.
Greg
