1

Specifically, I was running a node.js application on port 6969 which I thought was strictly local. I discovered this was not the case when I ran nmap <myip> from a different computer and found that it showed port 6969 open as a service called acmsoda. This is strange in the first place, since acmsoda seems to be a torrenting related service, of which I don't have any relevant software installed. What's weirder though, is that I changed the port of my node.js application to 6968 and it now no longer shows up remotely using nmap (although it is still remotely accessible).

Is there something about port 6969 on OSX that makes it unfiltered? Should I be weary of using this port?

  • What was the exact nmap command you used? it sounds like nmap has 6969 in it's database but not 6968. Also, the second scan probably didn't probe 6968. – mk444 Dec 30 '15 at 10:06
  • Ah, I believe you're right- the command I ran only probed 1000 ports, and I assume nmap intentionally prioritizes commonly open ports in its limited scans. – Ari Dec 30 '15 at 10:17
  • That being said, it's still interesting that it characterizes any opening on port 6969 as acmsoda, regardless of its actual nature – Ari Dec 30 '15 at 10:18
  • 2
    That would most likely just be what nmap has in it's database as the default service for 6969. What if you try an nmap scan directed specifically at port 6968? – mk444 Dec 30 '15 at 10:28
4

There are no such things as local ports. Whether a port is is accessible from localhost only or from outside depends only on the interface it is bound to. So if you bind a port to IP 127.0.0.1 then it's attached to lo(opback) interface and that is local-only. If you bind the port to all interfaces with IP 0.0.0.0 then it is accessible from everywhere, unless there is a firewall blocking the access. The reason why nmap is saying 6969/TCP is acmsoda is because nmap has a built-in list of default ports for common services. It is not even trying to guess what the actual service is. Similarly if you move your standard SSH port (22/TCP) to another port, nmap fails to identify the service properly. You have to explicitly tell nmap to try and identify a service in a port and its version number. I'm not OSX guy so don't know how the firewall is there by default but in all cases it's recommended to close all incoming ports by default and only open ports for needed services case by case.

1

you need to know the default behaviors of nmap :

1) nmap [ip]

nmap will scan the most common 1000 port and won't try to read the software banner but will resolve the service from it internal list like https://svn.nmap.org/nmap/nmap-services. port 6968 is not in the 1000 common port so nmap won't try to connect to the port.

2) nmap [ip] -p 6869 -sV

nmap will try to connect on port 6869 and read the port banner to find the good running service.

  • While this is very useful information chaput - it doesn't really answer the question. I think you're saying that port 6968 isn't being scanned by nmap and giving instructions for getting better data from nmap, but you need some more explanatory text. – Neil Smithline Dec 30 '15 at 21:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.