Thanks,
My grep listen returns that it’s mosquitto doing the listening.
I’ll as you said in the link take it up with mosquito
tcp LISTEN 0 100 127.0.0.1:26002 *:* users:(("nxnode.bin",pid=1281,fd=7))
tcp LISTEN 0 128 *:22 *:* users:(("dropbear",pid=624,fd=3))
tcp LISTEN 0 128 *:1880 *:* users:(("node-red",pid=5345,fd=21))
tcp LISTEN 0 128 127.0.0.1:8088 *:* users:(("influxd",pid=5354,fd=3))
tcp LISTEN 0 128 127.0.0.1:7002 *:* users:(("nxnode.bin",pid=1281,fd=19))
tcp LISTEN 0 100 127.0.0.1:1883 *:* users:(("mosquitto",pid=5337,fd=5))
tcp LISTEN 0 50 *:445 *:* users:(("smbd",pid=5313,fd=32))
tcp LISTEN 0 100 *:4000 *:* users:(("nxd",pid=807,fd=3))
tcp LISTEN 0 100 127.0.0.1:21024 *:* users:(("nxserver.bin",pid=481,fd=8))
tcp LISTEN 0 100 127.0.0.1:12002 *:* users:(("nxnode.bin",pid=1281,fd=16))
tcp LISTEN 0 100 127.0.0.1:25002 *:* users:(("nxclient.bin",pid=1318,fd=7))
tcp LISTEN 0 50 *:139 *:* users:(("smbd",pid=5313,fd=33))
tcp LISTEN 0 32 :::21 :::* users:(("proftpd",pid=5292,fd=0))
tcp LISTEN 0 128 :::8086 :::* users:(("influxd",pid=5354,fd=306))
tcp LISTEN 0 128 :::22 :::* users:(("dropbear",pid=624,fd=4))
tcp LISTEN 0 128 :::3001 :::* users:(("grafana-server",pid=5362,fd=12))
tcp LISTEN 0 128 ::1:7002 :::* users:(("nxnode.bin",pid=1281,fd=17))
tcp LISTEN 0 100 ::1:1883 :::* users:(("mosquitto",pid=5337,fd=6))
tcp LISTEN 0 50 :::445 :::* users:(("smbd",pid=5313,fd=30))
tcp LISTEN 0 100 :::4000 :::* users:(("nxd",pid=807,fd=4))
tcp LISTEN 0 50 :::139 :::* users:(("smbd",pid=5313,fd=31))