0

I see from iptables that my Centos 7 machine is receiving and sending out packets on ports 80 and 443. I don't have a webserver running, and netstat returned nothing for those ports.

Is this normal?

Improve this question
2
  • Please post the iptables rule list that makes you think this is the case.
    – Mark Wagner
    Dec 16, 2016 at 0:41
  • Both ports are open for input and output. I can understand receiving packets, I don't understand what program is replying to them and why:
    – Gavin Serra
    Dec 16, 2016 at 8:02

2 Answers 2

Reset to default
3

tcpdump port 80 and tcpdump port 443 should let you see what is happening, you might need to change the default interface using -i eth1 syntax in case it is happening on a different interface to the default. Check -i lo as well just in case!

If iptables is definitely showing it in the OUTPUT table counters then it might be sending out responses to tell other hosts that the port is closed. If this is the case then if you add a rule on the INPUT table to DROP rather than REJECT then that should put a stop to it.

I doubt the following is helpful if netstat -pauntl shows nothing, but the other thing you could try is to telnet (telnet) or netcat (nc) to port 80, and use openssl s_client -connect 127.0.0.1:443 to connect to port 443 and see if you get anywhere.

Improve this answer
2
  • Thanks Paul :) The iptables rules are ACCEPT for input and output for both ports (I'll shortly be installing Apache). I was worried why it was replying (assuming there was some sort of malware running), but I think you're right that this is normal.
    – Gavin Serra
    Dec 16, 2016 at 8:14
  • You're welcome. If the rules are ACCEPT for both ports then they will respond with a tcp reset packet to indicate the port is closed.
    – bao7uo
    Dec 16, 2016 at 8:29
-1

Ports 80 and 443 are used for all HTTP and HTTPS traffic, respectively. So, when you doing anything involving HTTP(S), including yum (https://www.centos.org/forums/viewtopic.php?t=30338) and other common tools (wget, curl, git, etc.), you are sending traffic and receiving responses from other people's webservers. In short, yes, this is normal; if you suspect something is wrong, try looking at where you are connecting to.

Improve this answer
2
  • Ports 80 and 443 are the destination ports for HTTP and HTTPS traffic, but the source ports from GavinSerra's machine will be different (above 1024, more like in the tens of thousands range) tcpdump src port 80 or src port 443 will confirm this, you will see none of your web browsing traffic in there. The question sounds like: receiving traffic with a destination of 80 and and 443 and sending out traffic with a source port of 80 and 443.
    – bao7uo
    Dec 15, 2016 at 22:10
  • Yes. Sorry, I should have been more specific.
    – Gavin Serra
    Dec 16, 2016 at 8:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .