Thanks - that makes sense. I'm still not seeing anything suspicious.
Greg@DiskStation:/$ sudo netstat -lpnt
We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:
#1) Respect the privacy of others.
#2) Think before you type.
#3) With great power comes great responsibility.
Password:
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:5000 0.0.0.0:* LISTEN 8269/nginx: master
tcp 0 0 0.0.0.0:5001 0.0.0.0:* LISTEN 8269/nginx: master
tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN 8289/smbd
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 8269/nginx: master
tcp 0 0 172.16.172.200:50001 0.0.0.0:* LISTEN 9621/dms
tcp 0 0 0.0.0.0:50002 0.0.0.0:* LISTEN 9898/lighttpd
tcp 0 0 0.0.0.0:57654 0.0.0.0:* LISTEN 12074/python2.7
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 6196/sshd
tcp 0 0 127.0.0.1:5432 0.0.0.0:* LISTEN 7924/postgres
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 8269/nginx: master
tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN 8289/smbd
tcp6 0 0 :::8008 :::* LISTEN 12074/python2.7
tcp6 0 0 :::5000 :::* LISTEN 8269/nginx: master
tcp6 0 0 :::5001 :::* LISTEN 8269/nginx: master
tcp6 0 0 :::139 :::* LISTEN 8289/smbd
tcp6 0 0 :::5005 :::* LISTEN 10207/httpd
tcp6 0 0 :::80 :::* LISTEN 8269/nginx: master
tcp6 0 0 :::22 :::* LISTEN 6196/sshd
tcp6 0 0 :::443 :::* LISTEN 8269/nginx: master
tcp6 0 0 :::445 :::* LISTEN 8289/smbd
Greg@DiskStation:/$