as mentioned in the title I have disabled Network Discovery for all of the 3 profiles yet when I run an NMap scan, the port comes up to be open. I have also run the command netstat -a -b to find the services running on ports, but port 5357 does not show up in it all.

Is there something I am missing outright here? Can you please point me in the right direction as to how can I stop port 5357 from showing as open instead of outright blocking it.

  • That really depends on your environment. Is this a cooperate network or your own home network?
    – user163495
    Commented Sep 18, 2019 at 12:22
  • It's a small corporate network. Does that affect? If yes, can you explain how? Commented Sep 18, 2019 at 12:37
  • 1
    Corporate networks may include filters, which redirect traffic of certain ports. For instance a ping to may silently be answered by Thus, even if no application on would listen to port 5357, the port scan for would still show port 5357 as open, because nmap received an answer for this port.
    – user163495
    Commented Sep 18, 2019 at 12:42
  • Is there a way I can check for this filters? Also, can I know which host in reality is replying to the NMap ping? Commented Sep 18, 2019 at 12:47
  • You can use Wireshark to get a better view of what goes over the wire.
    – user163495
    Commented Sep 18, 2019 at 12:48

1 Answer 1


Depending on your network configuration, requests may not be always answered by the host the request was sent to. For example, a firewall, router or switch may be configured to forward any traffic to TCP port 5357 to

As a result, when conducting a port scan for any host in this network, TCP port 5357 appears to be "open" for every host, but in reality, every request is answered just by one host.

In your scenario, it might very well be that port 5357 on one specific host (e.g. is closed. nmap would still consider it as "open", because a request for would receive a response.

nmap is simply not able to tell whether or not the response came from the host or not.

How can I make sure this is what is happening?

You can use Wireshark or similar tools on and see if packets sent to this host on this port actually arrive there. If they don't, but nmap still considers the port as open, then you are not communicating with this host.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .