I see from iptables that my Centos 7 machine is receiving and sending out packets on ports 80 and 443. I don't have a webserver running, and netstat returned nothing for those ports.
Is this normal?
I see from iptables that my Centos 7 machine is receiving and sending out packets on ports 80 and 443. I don't have a webserver running, and netstat returned nothing for those ports.
Is this normal?
tcpdump port 80
and tcpdump port 443
should let you see what is happening, you might need to change the default interface using -i eth1
syntax in case it is happening on a different interface to the default. Check -i lo
as well just in case!
If iptables is definitely showing it in the OUTPUT table counters then it might be sending out responses to tell other hosts that the port is closed. If this is the case then if you add a rule on the INPUT table to DROP rather than REJECT then that should put a stop to it.
I doubt the following is helpful if netstat -pauntl
shows nothing, but the other thing you could try is to telnet (telnet
) or netcat (nc
) to port 80, and use openssl s_client -connect 127.0.0.1:443
to connect to port 443 and see if you get anywhere.
Ports 80 and 443 are used for all HTTP and HTTPS traffic, respectively. So, when you doing anything involving HTTP(S), including yum (https://www.centos.org/forums/viewtopic.php?t=30338) and other common tools (wget, curl, git, etc.), you are sending traffic and receiving responses from other people's webservers. In short, yes, this is normal; if you suspect something is wrong, try looking at where you are connecting to.
tcpdump src port 80 or src port 443
will confirm this, you will see none of your web browsing traffic in there. The question sounds like: receiving traffic with a destination of 80 and and 443 and sending out traffic with a source port of 80 and 443.