I have a server (CentOS 6 64, fully updated) with a ssh backdoor on port 6108
The ssh has a different configuration from the standard ssh on port 22
netstat does not list open port, ss does but is not able to get the PID:
# ss -lnp | grep 6108
LISTEN 0 20 *:6108 *:*
Other means of detect do not show the backdoor.
If you push the "extra ice" button on the soft drink vending machine,
you won't get any ice.
If you push the "no ice" button, you'll get ice, but no cup.