Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was running a routine security check of the machines I manage today and found in my nmap scans that TCP/554 is open, although when I run 'netstat -an' on the machine itself it doesn't show up, same result if I nmap the host locally.

I then tried connecting to on tcp/554 and it is open and it seems all hosts 'have the port open'.

Obviously my ISP is doing something here but then I tried the same on my iphone via a 3G connection and it returns the same results. My ISP is a satellite ISP and my phone/3G connection is with a totally separate provider. Any ideas ?

share|improve this question
up vote 5 down vote accepted

I had a similar issue. For me, it turned out Apple Time Capsule was making it appear that ports 21, 554, and 7070 were open (it would proxy requests and not check if connections were accepted until later in the exchange.) So, if you're using an Apple networking device, I'd check there.

share|improve this answer

tcp/554 is rtsp - Real Time Streaming Protocol. Some types of streaming media (RealAudio, QuickTime, and others) use this port. A web server would typically have this open and listening if there are any types of these activities.

share|improve this answer
My box doesn't run any web service...that is why I am concerned – Hilton D Feb 13 '10 at 23:38
If the machine is windows you can run "netstat -a -b -v -n", to display the processes associated with a particular open port. On linux, "netstat -a -p -v -n". – Greg Askew Feb 14 '10 at 23:11
Thanks Greg. I ran that before I posted this question - nothing is listening on that port which is why I think that my ISP / router is faking something... – Hilton D Feb 20 '10 at 9:04

Do a TCP trace-route (yes you can do not only ICMP) to your destination. You will then see where the connection terminates. At your ISP (or somebody else on the way) or at your real destination. Compare with ICMP trace-route or trace of other ports.

You can use nping from the nmap package to do the trace.

share|improve this answer
I believe the normal case of traceroute uses UDP, though I may be in error. In any case, however, it tends to listen for ICMP TTL exceeded messages on the return path. – Falcon Momot Sep 15 '13 at 19:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.