up vote 1 down vote favorite
share [g+] share [fb]

I have a webserver that hosts various websites for me. The two services that are accessible outside are SSH and Apache2. These are running on a non-standard and standard port, respectively. All other ports are closed explicitly via arno-iptables-firewall. The host is running Debian Testing.

I noticed that a scan of the host using nmap produced different results from different PCs. From my laptop on my home network (behind a BT Homehub), I get the following:

Not shown: 996 filtered ports
PORT     STATE SERVICE
80/tcp   open  http
554/tcp  open  rtsp
7070/tcp open  realserver
9000/tcp open  cslistener

whereas scanning from a US-based server with nmap 5.00 and a Linux box in Norway running nmap 5.21 I get the following:

Not shown: 998 filtered ports
PORT     STATE SERVICE
80/tcp   open  http
9000/tcp open  cslistener

so I hope it's my internal network or ISP that's playing up, but I cannot be sure.

Running a netstat -l | grep 7070 produces nothing. Similarly for port 554.

Can anyone explain the peculiarities I'm seeing?

link|improve this question
Whether both the results are of the scans done at the same time. – pradeepchhetri Nov 13 '11 at 20:02
1  
Are you by any chance using an Apple airport extreme or Apple time capsule in your home network? – faker Nov 13 '11 at 20:07
I've got a Buffalo NAS which runs a DLNA-compatible service I believe. – atc Nov 13 '11 at 20:45
feedback

3 Answers

up vote 1 down vote accepted

This is most likely something in the line, those 2 ports (554/7070) are for realplayers RealServers.

http://service.real.com/firewall/adminfw.html

link|improve this answer
I agree with you. Thanks. I've done what Nickgrim suggested and it proved I could still open the port (assuming no rootkit replaced the netcat, netstat and other related binaries to trick me!). – atc Nov 14 '11 at 10:57
BTW, how can I prove this is the case? – atc Nov 14 '11 at 10:57
@atc: telnet to your newly-listening netcat, and check that it receives what you type at it. – nickgrim Nov 14 '11 at 15:21
feedback
up vote 5 down vote

I'd be inclined to blame your ISP or something between you and your server for this. If you just want to reassure yourself that those ports really are closed, you could try to listen on those ports and if it succeeds then it's safe to assume there's nothing already listening. Here's what I'm doing on my machine (which has Apache on port 80, and nothing on port 81):

$ sudo netcat -p 80 -l --wait 1    # Apache on port 80
Error: Couldn't setup listening socket (err=-3)
$ sudo netcat -p 81 -l --wait 1    # Nothing on port 81
(Ctrl-C)

EDIT: And to be sure that this really has worked, telnet to it from another box and check that netcat is receiving what you send (you'll probably want to increase the --wait timeout).

link|improve this answer
This has proven the issue isn't on the server -- a scan of another host listed the same ports open when they weren't! – atc Nov 14 '11 at 10:59
Though this didn't answer the direct question, I've given you an upvote as it was a great way of asserting whether the ports were used or not. Thanks for your input. – atc Nov 16 '11 at 8:21
feedback
up vote 0 down vote

I agree with nickgrim. Also you may want to try local nmap scans from the box itself

Compare the output of these:

nmap 127.0.0.1

nmap 1.2.3.4

Where 1.2.3.4 is your public ip

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.