On Sat, 24 Nov 2012 12:44:37 +0000, todorovic.s@googlemail.com said:
it probably makes far better reading to use netstat -tapn on the machine instead of nmap.
I agree that netstat is a better utility to use; however, you've made a classic mistake (I suspect) of learning a convenient set of switches for a utility and then using them without perhaps appreciating what each one does.
-a will show non-listening sockets, which is unnecessary in this case
-t will show tcp connections; however, DNS uses UDP (mostly), so not only is -t unnecessary, but the omission of -u means the command won't show what we need.
Better:
netstat -ulnp
Better still:
lsof -i udp:53