I see from iptables that my Centos 7 machine is receiving and sending out packets on ports 80 and 443. I don't have a webserver running, and netstat returned nothing for those ports.

Is this normal?

  • Please post the iptables rule list that makes you think this is the case. – Mark Wagner Dec 16 '16 at 0:41
  • Both ports are open for input and output. I can understand receiving packets, I don't understand what program is replying to them and why: – Gavin Serra Dec 16 '16 at 8:02

tcpdump port 80 and tcpdump port 443 should let you see what is happening, you might need to change the default interface using -i eth1 syntax in case it is happening on a different interface to the default. Check -i lo as well just in case!

If iptables is definitely showing it in the OUTPUT table counters then it might be sending out responses to tell other hosts that the port is closed. If this is the case then if you add a rule on the INPUT table to DROP rather than REJECT then that should put a stop to it.

I doubt the following is helpful if netstat -pauntl shows nothing, but the other thing you could try is to telnet (telnet) or netcat (nc) to port 80, and use openssl s_client -connect to connect to port 443 and see if you get anywhere.

| improve this answer | |
  • Thanks Paul :) The iptables rules are ACCEPT for input and output for both ports (I'll shortly be installing Apache). I was worried why it was replying (assuming there was some sort of malware running), but I think you're right that this is normal. – Gavin Serra Dec 16 '16 at 8:14
  • You're welcome. If the rules are ACCEPT for both ports then they will respond with a tcp reset packet to indicate the port is closed. – bao7uo Dec 16 '16 at 8:29

Ports 80 and 443 are used for all HTTP and HTTPS traffic, respectively. So, when you doing anything involving HTTP(S), including yum (https://www.centos.org/forums/viewtopic.php?t=30338) and other common tools (wget, curl, git, etc.), you are sending traffic and receiving responses from other people's webservers. In short, yes, this is normal; if you suspect something is wrong, try looking at where you are connecting to.

| improve this answer | |
  • Ports 80 and 443 are the destination ports for HTTP and HTTPS traffic, but the source ports from GavinSerra's machine will be different (above 1024, more like in the tens of thousands range) tcpdump src port 80 or src port 443 will confirm this, you will see none of your web browsing traffic in there. The question sounds like: receiving traffic with a destination of 80 and and 443 and sending out traffic with a source port of 80 and 443. – bao7uo Dec 15 '16 at 22:10
  • Yes. Sorry, I should have been more specific. – Gavin Serra Dec 16 '16 at 8:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.