13

I have a webserver that hosts various websites for me. The two services that are accessible outside are SSH and Apache2. These are running on a non-standard and standard port, respectively. All other ports are closed explicitly via arno-iptables-firewall. The host is running Debian Testing.

I noticed that a scan of the host using nmap produced different results from different PCs. From my laptop on my home network (behind a BT Homehub), I get the following:

Not shown: 996 filtered ports
PORT     STATE SERVICE
80/tcp   open  http
554/tcp  open  rtsp
7070/tcp open  realserver
9000/tcp open  cslistener

whereas scanning from a US-based server with nmap 5.00 and a Linux box in Norway running nmap 5.21 I get the following:

Not shown: 998 filtered ports
PORT     STATE SERVICE
80/tcp   open  http
9000/tcp open  cslistener

so I hope it's my internal network or ISP that's playing up, but I cannot be sure.

Running a netstat -l | grep 7070 produces nothing. Similarly for port 554.

Can anyone explain the peculiarities I'm seeing?

4
  • Whether both the results are of the scans done at the same time. Nov 13, 2011 at 20:02
  • 3
    Are you by any chance using an Apple airport extreme or Apple time capsule in your home network?
    – faker
    Nov 13, 2011 at 20:07
  • I've got a Buffalo NAS which runs a DLNA-compatible service I believe.
    – Alex
    Nov 13, 2011 at 20:45
  • This happens to me as well -- I'm behind an Apple Time Capsule. :(
    – pawstrong
    Nov 21, 2012 at 23:17

8 Answers 8

1

This is most likely something in the line, those 2 ports (554/7070) are for realplayers RealServers.

http://service.real.com/firewall/adminfw.html

3
  • I agree with you. Thanks. I've done what Nickgrim suggested and it proved I could still open the port (assuming no rootkit replaced the netcat, netstat and other related binaries to trick me!).
    – Alex
    Nov 14, 2011 at 10:57
  • BTW, how can I prove this is the case?
    – Alex
    Nov 14, 2011 at 10:57
  • @atc: telnet to your newly-listening netcat, and check that it receives what you type at it.
    – nickgrim
    Nov 14, 2011 at 15:21
11

I'd be inclined to blame your ISP or something between you and your server for this. If you just want to reassure yourself that those ports really are closed, you could try to listen on those ports and if it succeeds then it's safe to assume there's nothing already listening. Here's what I'm doing on my machine (which has Apache on port 80, and nothing on port 81):

$ sudo netcat -p 80 -l --wait 1    # Apache on port 80
Error: Couldn't setup listening socket (err=-3)
$ sudo netcat -p 81 -l --wait 1    # Nothing on port 81
(Ctrl-C)

EDIT: And to be sure that this really has worked, telnet to it from another box and check that netcat is receiving what you send (you'll probably want to increase the --wait timeout).

2
  • This has proven the issue isn't on the server -- a scan of another host listed the same ports open when they weren't!
    – Alex
    Nov 14, 2011 at 10:59
  • Though this didn't answer the direct question, I've given you an upvote as it was a great way of asserting whether the ports were used or not. Thanks for your input.
    – Alex
    Nov 16, 2011 at 8:21
7

Your router is probably to blame. I was just wondering if this was an issue with being on an OpenVZ host, and found this article: Are ports 21, 554, and 7070 open or closed? The answer is yes.

This makes sense for me, as I'm currently on a crappy FiOS Actiontec router. Any combination of nmap and netcat testing on the container and host node confirms that those ports are not really open.

3
  • 1
    +1 for crappy FiOS Actiontec router. I know your box's private keys (so do others, thanks to Little Black Box).
    – user145545
    Nov 19, 2014 at 6:23
  • I switched before I lost FiOS, but now I use a better secure router with my wireless "router" in AP mode. Anyone reading this article should check out that project linked. Nice blog also :) Feb 22, 2015 at 10:00
  • Just a heads up: this is still the case for Apple Airport Extreme right now. Found out the hard way while testing firewall settings for Amazon ec2 instance from my home network.
    – jlapoutre
    Sep 22, 2016 at 13:24
7

Various different routers (Verizon FiOS, BT Home Hub, Apple Airport Extreme, ...) show ports 554 and 7070 as open for all IPs for some reason.

Hackerific » False positive TCP ports!

1
  • 2
    +1 for the excellent Hackerific link. Jun 7, 2017 at 0:56
2

I moved an Windows 10 machine in ESXi, and the culprit for port 7070 open is AnyDesk. Apparently it listens on that port for incoming connection requests.

Hope it helps

1
  • It does, thank you. This was on 3 machines in this building and had me quite befuddled. Oct 13, 2022 at 16:00
0

I agree with nickgrim. Also you may want to try local nmap scans from the box itself

Compare the output of these:

nmap 127.0.0.1

nmap 1.2.3.4

Where 1.2.3.4 is your public ip

0

This may be an RTSP ALG (Application Layer Gateway) on your home hub intercepting traffic and providing a response.

0

Are you using a VM on ESXi Guest? I started to have fake 554/7070 results when I moved my Kali linux VM from Workstation to ESXi. You can verify latency:

nmap yourip --reason -p 7070 --traceroute

Check the different number of hops of 554 and 7070 ports with normal ports...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .