I see from iptables that my Centos 7 machine is receiving and sending out packets on ports 80 and 443. I don't have a webserver running, and netstat returned nothing for those ports.
Is this normal?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
tcpdump port 80 and
tcpdump port 443 should let you see what is happening, you might need to change the default interface using
-i eth1 syntax in case it is happening on a different interface to the default. Check
-i lo as well just in case!
If iptables is definitely showing it in the OUTPUT table counters then it might be sending out responses to tell other hosts that the port is closed. If this is the case then if you add a rule on the INPUT table to DROP rather than REJECT then that should put a stop to it.
I doubt the following is helpful if
netstat -pauntl shows nothing, but the other thing you could try is to telnet (
telnet) or netcat (
nc) to port 80, and use
openssl s_client -connect 127.0.0.1:443 to connect to port 443 and see if you get anywhere.
Ports 80 and 443 are used for all HTTP and HTTPS traffic, respectively. So, when you doing anything involving HTTP(S), including yum (https://www.centos.org/forums/viewtopic.php?t=30338) and other common tools (wget, curl, git, etc.), you are sending traffic and receiving responses from other people's webservers. In short, yes, this is normal; if you suspect something is wrong, try looking at where you are connecting to.