1

I'm a developer working on a CentOS7 server. Today I want to check the status of all ports of the server.

First I execute the command: firewall-cmd --zone=public --list-ports and I get this:

110/tcp 443/tcp 80/tcp 995/tcp 143/tcp 3306/tcp 993/tcp

All of ports above are opened by me so everything's fine.

Then I use another Linux PC and use nc to scan ports of the server (saying that the ip of the server is a.a.a.a):

nc -v -z -w2 a.a.a.a 1-4000

I get the same result.

After that, I use nc to scan ports using UDP:

nc -v -z -w2 -u a.a.a.a 1-4000

To my surprise, it seems that all of ports are opened because I get the result as below:

Connection to a.a.a.a port 1 [udp/tcpmux] succeeded!
found 0 associations
found 1 connections:
     1: flags=82<CONNECTED,PREFERRED>
    outif (null)
    src b.b.b.b port 62086
    dst a.a.a.a port 2
    rank info not available

Connection to a.a.a.a port 2 [udp/compressnet] succeeded!
found 0 associations
found 1 connections:
     1: flags=82<CONNECTED,PREFERRED>
    outif (null)
    src b.b.b.b port 60795
    dst a.a.a.a port 3
    rank info not available

Connection to a.a.a.a port 3 [udp/compressnet] succeeded!
found 0 associations
found 1 connections:
     1: flags=82<CONNECTED,PREFERRED>
    outif (null)
    src b.b.b.b port 50133
    dst a.a.a.a port 4
    rank info not available

Connection to a.a.a.a port 4 [udp/*] succeeded!
found 0 associations
found 1 connections:
     1: flags=82<CONNECTED,PREFERRED>
    outif (null)
    src b.b.b.b port 64246
    dst a.a.a.a port 5
    rank info not available

Connection to a.a.a.a port 5 [udp/rje] succeeded!
found 0 associations
found 1 connections:
     1: flags=82<CONNECTED,PREFERRED>
    outif (null)
    src b.b.b.b port 50334
    dst a.a.a.a port 6
    rank info not available
...
...

Now I'm confused.
Why do all of ports are opened for UDP? Is it safe? If it's not safe, why doesn't the firewall close them?
For me, "port is open" means that some program or the system is listening on it. For example, 80/tcp means that my web program is listening on the port 80. If I'm right, does it mean that the server is listening on all of ports with UDP?
Or "port is open" just means that the firewall doesn't block the port so that you can use some program to listen on it?

1

The UDP response is a false-positive, you can disregard this. UDP is a connectionless/stateless protocol so it isn't expecting anything back... no response, bad response... it's all the same. TCP is a stateful protocol, as both endpoints retain information about each other's state, acknowledgements are required, and it can retransmit.

Reading about stateless protocols: https://en.wikipedia.org/wiki/Stateless_protocol

TCP State: https://upload.wikimedia.org/wikipedia/commons/a/a2/Tcp_state_diagram_fixed.svg

  • So the result that I got just means that UDP datagram is sent to the ports? If so, does it mean that I can't distinguish whether some program on the server is listening a port with UDP or not with the command nc -u? – Yves Jul 11 '17 at 2:26
  • 'netstat -an | grep LISTEN' will list all the ports (both tcp and udp) being listened on. If you have root permission you can add a '-p' to the netstat to see the process listening. – Brandon Xavier Jul 11 '17 at 2:37
  • @BrandonXavier Thank you but I just want to know if nc can tell me whether a port of a remote server is used by some program with UDP. – Yves Jul 11 '17 at 2:42
  • You did a netcat w/ the -z switch, which does a scan of all ports to see if they can be connected. This would be a method of say, scanning a remote server to see if a port is open/listening/responding. For reasons stated above, it's not very useful for UDP. A more reliable way, as Brandon mentioned above, is to use netstat to see what UDP ports are LISTENING. This won't show everything, particularly for high/ephemeral ports, as those can be transient in nature (opened and closed). But it'll generally give you an idea of what is indeed in use. – Ulfy Jul 11 '17 at 2:51
  • I should note, netstat is done from the host/server in question. It's not something you invoke from afar. – Ulfy Jul 11 '17 at 2:54

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.