0

as mentioned in the title I have disabled Network Discovery for all of the 3 profiles yet when I run an NMap scan, the port comes up to be open. I have also run the command netstat -a -b to find the services running on ports, but port 5357 does not show up in it all.

Is there something I am missing outright here? Can you please point me in the right direction as to how can I stop port 5357 from showing as open instead of outright blocking it.

  • That really depends on your environment. Is this a cooperate network or your own home network? – MechMK1 Sep 18 at 12:22
  • It's a small corporate network. Does that affect? If yes, can you explain how? – Malabika Sen Sep 18 at 12:37
  • 1
    Corporate networks may include filters, which redirect traffic of certain ports. For instance a ping to 10.0.0.1:5357 may silently be answered by 10.5.5.5:5357. Thus, even if no application on 10.0.0.1 would listen to port 5357, the port scan for 10.0.0.1 would still show port 5357 as open, because nmap received an answer for this port. – MechMK1 Sep 18 at 12:42
  • Is there a way I can check for this filters? Also, can I know which host in reality is replying to the NMap ping? – Malabika Sen Sep 18 at 12:47
  • You can use Wireshark to get a better view of what goes over the wire. – MechMK1 Sep 18 at 12:48
1

Depending on your network configuration, requests may not be always answered by the host the request was sent to. For example, a firewall, router or switch may be configured to forward any traffic to TCP port 5357 to 203.0.113.1:5357.

As a result, when conducting a port scan for any host in this network, TCP port 5357 appears to be "open" for every host, but in reality, every request is answered just by one host.

In your scenario, it might very well be that port 5357 on one specific host (e.g. 203.0.113.29) is closed. nmap would still consider it as "open", because a request for 203.0.113.29:5357 would receive a response.

nmap is simply not able to tell whether or not the response came from the host or not.

How can I make sure this is what is happening?

You can use Wireshark or similar tools on 203.0.113.29 and see if packets sent to this host on this port actually arrive there. If they don't, but nmap still considers the port as open, then you are not communicating with this host.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.