Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a webserver that hosts various websites for me. The two services that are accessible outside are SSH and Apache2. These are running on a non-standard and standard port, respectively. All other ports are closed explicitly via arno-iptables-firewall. The host is running Debian Testing.

I noticed that a scan of the host using nmap produced different results from different PCs. From my laptop on my home network (behind a BT Homehub), I get the following:

Not shown: 996 filtered ports
PORT     STATE SERVICE
80/tcp   open  http
554/tcp  open  rtsp
7070/tcp open  realserver
9000/tcp open  cslistener

whereas scanning from a US-based server with nmap 5.00 and a Linux box in Norway running nmap 5.21 I get the following:

Not shown: 998 filtered ports
PORT     STATE SERVICE
80/tcp   open  http
9000/tcp open  cslistener

so I hope it's my internal network or ISP that's playing up, but I cannot be sure.

Running a netstat -l | grep 7070 produces nothing. Similarly for port 554.

Can anyone explain the peculiarities I'm seeing?

share|improve this question
    
Whether both the results are of the scans done at the same time. –  pradeepchhetri Nov 13 '11 at 20:02
1  
Are you by any chance using an Apple airport extreme or Apple time capsule in your home network? –  faker Nov 13 '11 at 20:07
    
I've got a Buffalo NAS which runs a DLNA-compatible service I believe. –  atc Nov 13 '11 at 20:45
    
This happens to me as well -- I'm behind an Apple Time Capsule. :( –  pawstrong Nov 21 '12 at 23:17
add comment

4 Answers 4

up vote 1 down vote accepted

This is most likely something in the line, those 2 ports (554/7070) are for realplayers RealServers.

http://service.real.com/firewall/adminfw.html

share|improve this answer
    
I agree with you. Thanks. I've done what Nickgrim suggested and it proved I could still open the port (assuming no rootkit replaced the netcat, netstat and other related binaries to trick me!). –  atc Nov 14 '11 at 10:57
    
BTW, how can I prove this is the case? –  atc Nov 14 '11 at 10:57
    
@atc: telnet to your newly-listening netcat, and check that it receives what you type at it. –  nickgrim Nov 14 '11 at 15:21
add comment

I'd be inclined to blame your ISP or something between you and your server for this. If you just want to reassure yourself that those ports really are closed, you could try to listen on those ports and if it succeeds then it's safe to assume there's nothing already listening. Here's what I'm doing on my machine (which has Apache on port 80, and nothing on port 81):

$ sudo netcat -p 80 -l --wait 1    # Apache on port 80
Error: Couldn't setup listening socket (err=-3)
$ sudo netcat -p 81 -l --wait 1    # Nothing on port 81
(Ctrl-C)

EDIT: And to be sure that this really has worked, telnet to it from another box and check that netcat is receiving what you send (you'll probably want to increase the --wait timeout).

share|improve this answer
    
This has proven the issue isn't on the server -- a scan of another host listed the same ports open when they weren't! –  atc Nov 14 '11 at 10:59
    
Though this didn't answer the direct question, I've given you an upvote as it was a great way of asserting whether the ports were used or not. Thanks for your input. –  atc Nov 16 '11 at 8:21
add comment

Your router is probably to blame. I was just wondering if this was an issue with being on an OpenVZ host, and found this article: Are ports 21, 554, and 7070 open or closed? The answer is yes.

This makes sense for me, as I'm currently on a crappy FiOS Actiontec router. Any combination of nmap and netcat testing on the container and host node confirms that those ports are not really open.

share|improve this answer
add comment

I agree with nickgrim. Also you may want to try local nmap scans from the box itself

Compare the output of these:

nmap 127.0.0.1

nmap 1.2.3.4

Where 1.2.3.4 is your public ip

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.