If I do a port scan then I get random open ports. Every time I hit the button "scan" I get other open ports, except for the ipp 631 which is always open. see screens:

portscan1.png
portscan2.png
portscan3.png


If I do netstat -lp 127.0.0.1 . I don't get the random open ports. Only the ipp 631 which is always there and has the STATE "LISTEN", and some udp which have an empty "STATE"

If I do nmap 127.0.0.1 I only get the ipp 631 port

So, what is going on? How can I find the processes that opens the random ports?

thanks