389 is ldap - maybe you openldap installed? you can shutdown the service with "/etc/rc.d/init.d/ldap stop" or edit your rc.config and disable ldap... bye andre "Alan" cable.com> cc: Subject: [suse-security] How to close the port in SuSe 7.1 [389],[1002] 11.10.2001 19:18 Dear all, I have using the iptable to block all the port and shutdown most of service. I just only open the ssh service. But I have detected my linux box have open 2 port. There are 389 and 1002. Thereforce how can I close those port? Thank Alan Au