4

I have a Windows 2012 R2 server used as web server, with ports for web (80, 443, and 8080) open for public sites hosted on it. Doing some security checks on it, I found it's listening on port 110 too:

However, there is no POP3 service, or any mail service, running on that server.

It has both node.js and IIS installed, in case it's relevant.

The weird part is that port 110 is not listed when running netstat -na on the server, and it can't find anything listening on that port:

I even added inbound/outbound rules to block port 110 on the server in the Firewall. Still no effect.

I can even connect with telnet to that port and send data, though the display is weird:

Why and how is this port open? How to block it?

  • Any more luck with an added -q switch? Or resource monitor if you want a GUI. – Lenniey Aug 16 '18 at 8:37
  • @Lenniey thanks, but "-q" for what? For PortQry it just makes it quiet, and no such switch for netstat, so I am not sure what you mean, sorry. – Shadow Wizard Aug 16 '18 at 8:44
  • Hm...on my Windows 2012R2 servers I can use netstat -q to Display all connections, listening ports, and [...]. Have a look at the resource monitor then, especially the network tab or tcpview from the sysinternals suite. – Lenniey Aug 16 '18 at 8:56
  • @Lenniey weird, probably something you installed, no -q switch for me. Checked in Resource Monitor, no port 110 listed in the network tab anywhere – Shadow Wizard Aug 16 '18 at 9:32
  • 2
    @yagmoth555 yeah, I already asked the network admin to contact the ISP and request closing the port. (They own and operate the s-box.) – Shadow Wizard Aug 16 '18 at 12:53
2

Confirmed to be a "S-Box Security Internet Firewall" by tracing the traffic and connecting to every hop IP using telnet on port 110. All traffic on port 110 passing this device seems to be intercepted.

1

You probably have firewall in between your workplace (where you were running scan) and your server. The simplest check would be to try connecting to said port for the machine itself:

telnet 123.123.123.123 110

If it doesn't connect, you are most likely OK.

  • i.stack.imgur.com/scFrg.png yeah, it doesn't work on the server itself, but still not sure there's no risk. How can firewall "listen" on a port though? And why 110 of all ports? – Shadow Wizard Aug 16 '18 at 10:42
  • Try to check if port is open from another place. Some firewalls may have some services and such running on random ports (F.E., your local sysadmin decided to block this port in your office. Software that he uses to do so behaves in a way, that it accepts connections on port and filters it). – Tamerlan Abu Aug 16 '18 at 10:44
  • 110 isn't just random port, it should be used only by POP3 service which makes this whole thing weird. – Shadow Wizard Aug 16 '18 at 10:48
  • @ShadowWizard It's not open on the local host itself, so your weird output is definitely something else intercepting the connection attempt. Go find whoever is responsible for IT security where you work and they can probably tell you what it is. – Michael Hampton Aug 16 '18 at 13:20
  • @MichaelHampton yeah, already found, see comments under question. – Shadow Wizard Aug 16 '18 at 13:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.