Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My friend is currently running the default firewall on his mac with "Block all incoming connection" (except the basic ones like 80). I just scanned his mac for open ports and I found the following:

 Open TCP Port:     3128        ndl-aas
 Open TCP Port:     8080        http-alt

Is it normal to have those ports open, or does he have something fuzzy installed?

share|improve this question
add comment

1 Answer

Well, "block all incoming connections" should block all incoming connections so you should not be able to find any open port. Note that even port 80 ought not be open either: a typical desktop system has no business running a Web server itself.

The fact that there are open ports is indicative that the "block all incoming connections" setting does not work as expected. Port 3128 is a traditional port of an HTTP proxy.

What you report does not add up. Either the Mac runs some servers, does not block incoming connections, and could be under active external hostile control. Or maybe you made a typing error and you are not scanning the machine you believe you are scanning.

share|improve this answer
    
Thanks for your answer! It actually says block all incoming connections, but underneath it says except services like DHCP, IPsec and so on. Thanks for the info about port 80, didn't knew that. Do you have any info about 8080? Should it be open, or is it like port 80? –  MyName931 Oct 7 '13 at 15:45
    
And one other thing. I scanned the computer from the computer itself. Does that change the result? I used a tool similar to nmap. –  MyName931 Oct 7 '13 at 15:47
    
One more thing. I'm not running anything similar to a server. Just surfing the web and stuff. –  MyName931 Oct 7 '13 at 15:51
2  
Oh yes, it changes quite a lot of things. "Incoming connections blocking" is usually applied on connections from the outside. By scanning from the machine itself you are seeing the services that the machine runs for itself, which are bound to localhost. If you want to see what the machine runs, try netstat -an and look at the "LISTEN" lines. If you want to see what outsiders see from the machine, you must do the scan from their position, i.e. outside. On another machine. –  Tom Leek Oct 7 '13 at 15:53
    
Thank you! Will return if I have any more questions! –  MyName931 Oct 7 '13 at 16:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.