My friend is currently running the default firewall on his mac with "Block all incoming connection" (except the basic ones like 80). I just scanned his mac for open ports and I found the following:

 Open TCP Port:     3128        ndl-aas
 Open TCP Port:     8080        http-alt

Is it normal to have those ports open, or does he have something fuzzy installed?

1 Answer 1


Well, "block all incoming connections" should block all incoming connections so you should not be able to find any open port. Note that even port 80 ought not be open either: a typical desktop system has no business running a Web server itself.

The fact that there are open ports is indicative that the "block all incoming connections" setting does not work as expected. Port 3128 is a traditional port of an HTTP proxy.

What you report does not add up. Either the Mac runs some servers, does not block incoming connections, and could be under active external hostile control. Or maybe you made a typing error and you are not scanning the machine you believe you are scanning.

  • Thanks for your answer! It actually says block all incoming connections, but underneath it says except services like DHCP, IPsec and so on. Thanks for the info about port 80, didn't knew that. Do you have any info about 8080? Should it be open, or is it like port 80?
    – MyName931
    Commented Oct 7, 2013 at 15:45
  • And one other thing. I scanned the computer from the computer itself. Does that change the result? I used a tool similar to nmap.
    – MyName931
    Commented Oct 7, 2013 at 15:47
  • One more thing. I'm not running anything similar to a server. Just surfing the web and stuff.
    – MyName931
    Commented Oct 7, 2013 at 15:51
  • 2
    Oh yes, it changes quite a lot of things. "Incoming connections blocking" is usually applied on connections from the outside. By scanning from the machine itself you are seeing the services that the machine runs for itself, which are bound to localhost. If you want to see what the machine runs, try netstat -an and look at the "LISTEN" lines. If you want to see what outsiders see from the machine, you must do the scan from their position, i.e. outside. On another machine.
    – Tom Leek
    Commented Oct 7, 2013 at 15:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .