Questions tagged [ports]
In computer networking a port is a software construct serving as a communications endpoint in a computer's host OS.
339
questions
2
votes
2answers
3k views
Service running on a closed port?
I just finished scanning a host and I found something unusual. My question is regarding port 50000 and 50002. Nmap shows that these ports are closed and also identifies the services running on them!...
2
votes
1answer
276 views
What is UDP port 56183
We seen suspicious probing from source port 53 to destination port 56183. May I know what services use port 56183 (udp)?
2
votes
2answers
2k views
Telnet port open on my router public IPv6 address
Recently I upgraded my home router into this one. It is a cheap one, but it has features I needed: IPv6 support and Gigabit Ethernet.
So I decided to give IPv6 a try. I configured a Hurricane ...
2
votes
3answers
264 views
Closed Port security
I have what I think is a security IT question (I'm more of a programmer myself).
Assuming I am running a dedicated machine (say a PC) for a single program, meaning that the only port visible and open ...
2
votes
2answers
81 views
Is there practical risk to having UDP ports open?
I understand that everything is potentially an attack vector, but I would like to ask a practical question about UDP ports
Suppose you're pentesting some small organisation and you found a couple of ...
2
votes
2answers
9k views
What purpose serve port 1900 in home router
Why would home router have port 1900/tcp (upnp) open? What kind of purpose would that serve for the operator (service provider)?
I searched info about it and found this an article saying:
Security ...
2
votes
2answers
2k views
What can be a reason you DONT want to use port 443 for SSL communications
I have a very open question which I dont know if it's allowed but I am so curious about any possible answer.
We are trying to make a connection to a other service for my company and the webservice ...
2
votes
1answer
59 views
Access Control Lists - Why block a port rather than block a protocol?
I am studying for my Security + exam. I have just learned that ACLs can be designed to block ports and/or entire protocols. The book I am reading states an example:
"if you want to block HTTP traffic,...
2
votes
2answers
351 views
do SRV records make a system more vulnerable or expose too much
We are all pretty comfortable with the fact that if ports 80 and 443 are open that these are for http even though some companies block 22 forcing people to repurpose 443 for ssh. So, those instances ...
2
votes
2answers
3k views
Most efficient way to scan for webservers
Lets say I want to scan a large amount of ip addresses for webservers running on port 80 (aware that there are other ports for webservers, ignoring for example).
What would be the most efficient way ...
2
votes
3answers
956 views
Is there any risk to having many “unused” ports open through firewalls and routers [duplicate]
I have a server I am using to host public internet services where I want to start and stop many instances, lets say up to 50 per physical server. The architecture of the software means each instance ...
2
votes
1answer
220 views
Dealing with “trojan” ports
We have a SOC which "monitors" our network activity, it basically collects all logs from all our firewalls and creates reports.
We have a huge network with hundreds of servers and upto 2000 users, ...
2
votes
3answers
5k views
How to scan for ports opened by TCP/UDP sockets with nmap or any other tool?
I'm new to nmap and I've been digging with it lately to scan some devices on the current LAN for ports opened by socket programs which are running.
First I ran a simple UDP server on my machine on ...
2
votes
2answers
12k views
Is Port Forwarding for bit torrent risky?
I have found that my connection decreased suddenly when downloading torrents. I diagnosed it with bit torrent and the answer is that i should do port forwarding on my modem/router! Is it risky?
2
votes
3answers
455 views
2 vs 3 tier network architecture
I am interested in how a 3-tier network topology (web/app/data) provides improved security than a 2-tier topology (web-app/data). I understand the concept of a DMZ as the initial contact point with ...
2
votes
1answer
205 views
Rogue device found on network
Whilst scanning my own network, I recently came across what seems like a rogue device. After running an nmap scan on it I found out it has four 'strange' ports open.
4096 (HTTP server)
13000 (Unknown,...
2
votes
2answers
610 views
What is this weird localhost IP traffic on multiple ports in the 5400-5600 range?
I am encountering an issue I recently have seen in my Fedora 23 machine (latest updates). I am getting about 130 IP packets passed back and forth over the lo interface in one go, every 1 second (like ...
2
votes
2answers
109 views
Why do ALGs restrict traffic on a given TCP port based on the protocol?
My understanding is that application level gateways restrict the traffic they proxy based on port and protocol - say HTTP over port 80 or MQTT over port 1883. Both types of traffic are using TCP as ...
2
votes
1answer
318 views
How to perform an idle scan against a target using Nmap with a list of zombies? [closed]
I want to perform port scan against a target but the firewall at the target only allows traffic to the ports through certain IP address/machines. I tried to perform an idle scan in Nmap but it only ...
2
votes
2answers
5k views
How do I scan my Routers Ports? [duplicate]
I recently scanned ports from within my LAN, but I recently read in order to determine whether Ports are open to the WAN I need to scan from outside the LAN, how do I do this?
2
votes
1answer
423 views
Static MAC address on Switches and routers
I was having a discussion with a friend of mine in IS industry and he insisted that setting static MAC addresses (i.e. port security) on devices were a effective way to block MAC spoofing. I found ...
2
votes
1answer
202 views
explanation of an nmap behaviour
I'm testing some vulnerabilities on a machine which has the port 22333 opened (it's used as the ssh port, and I can connect to it without any problem and the telned command get connected):
$ telnet ...
2
votes
1answer
4k views
Telnet Open, is this an exploit? [closed]
I am pentesting a server, and it appears my ports are open for telnet.
Upon accessing telnet, if I type "help" I only get these commands:
telnet> help
Commands may be abbreviated. Commands are:
...
2
votes
1answer
794 views
Effective blocking of SMB connections on AsusWRT
I recently was attacked by some cryptolocker (not sure if it's WannaCry) and now I am revising my network policies. For reaching this aim I want to disable all SMB-activity for infected PC. ...
2
votes
1answer
464 views
Multiple users sharing the same IP
I'm setting up a quite unusual proxy for a very specific niche case.
I'm allocating (ip,port) addresses to users, from which they can send and receive UDP and TCP packets.
e.g. say someone is ...
2
votes
2answers
1k views
Nmap scan report with all port status
Is there a way to ask nmap to print the final scan report with the state of all ports tested and the reason?
For example when the scan is launched with --reason :
Nmap scan report for 127.0.0.1
...
2
votes
2answers
800 views
nmap output to file different than interactive output?
I am running a simple SYN scan of all ports on all hosts that I found on a previous ping scan saved to a file: targets like this:
nmap -sS -p- -v -T5 -oN puzzling.txt -iL targets
As the scan runs ...
2
votes
1answer
1k views
nmap not running as root shows unknown open ports for a fraction of a second
On a server running Ubuntu 14.04.2 I was doing some basic security auditing when I ran the command nmap -p -d 1-65535 as a non-root user. Interestingly it reported a few (1-5 at a time, average, ...
2
votes
1answer
4k views
What is the fastest way to scan all ports of a single machine
I am doing some research and I need a very quick way to scan for open ports on a single machine. To provide some context, I know that my machine will have a port open waiting for UDP packets for about ...
2
votes
1answer
4k views
Detected Port Scanning Attack in ESET Smart Security
I receive a number of notifications from ESET Smart Security about Port Scanning attack. But I'm behind a router. But as far as I know, computers behind a router is not accessible from others (Please ...
2
votes
1answer
91 views
Can a VPN provider or actors within its infrastructure access open ports on the client machine?
From my understanding of a VPN, it essentially creates a network between the two 'machines'. So if I have open ports (e.g. HTTP, SSH) on my client machine, those can be accessed by the VPN provider or ...
2
votes
1answer
290 views
Is it safe to have port 443 unprotected by firewall without application?
Say I have a website, http://www.mostlysecuresite.com, which runs on a server at my house. Let's say I wanted to get an SSL cert in a few weeks. Because of this, I had my Port 443 forwarded on my ...
2
votes
1answer
165 views
Port Knock logs suggest machine has been compromised?
On my CentOS machine, all my ports are filtered with the Iptables rule:
DROP all -- * * 0.0.0.0/0 0.0.0.0/0
So from the Internet, every port timeouts.
The only way to ...
2
votes
1answer
289 views
Eavesdropping on a specific port of machine in the WLAN from a different machine, possible? (using arpspoof)
I'm using netcat -l 555 option to communicate between two computers(Linux) on port 555, is there any way I can eavesdrop to whats going on in that conversation from a 3rd computer?
After the second ...
2
votes
1answer
2k views
Open ports on router
I have a TP-Link TD W8970 modem/router. Just for fun i tried to perform a port scan on it. I found this:
$ nmap -p 1-65535 -n 192.168.1.1
Starting Nmap 6.00 ( http://nmap.org ) at 2016-01-21 16:17 ...
2
votes
2answers
167 views
Opening remote MySQL database to office IP address at default MySQL port risks?
I read a few questions regarding this topic that were pretty informative, but still wanted to pose my particular case.
My company wants to put our data in the MySQL tables we have through our web ...
2
votes
1answer
881 views
Understanding nmap output / author explanation …(Scapy)
I just read this example and explanation (below) in the OReilly book Security Power Tools (2007) in section 6.3 that is written by the creator of Scapy, Philippe Biondi. I think the example is very ...
2
votes
1answer
3k views
Why is nmap that slow on my system (ubuntu 14.04)?
I just started to learn something about portscanning with nmap. when i try to run an a nullscan or any other type on a virtual machine (win7 no firewall) the scan needs a lot of time to perform:
sebi@...
2
votes
1answer
823 views
How should I audit and monitor shared TCP ports in Windows?
Windows has a feature called .NET TCP Port Sharing which allows different .NET applications to share the same TCP/IP port.
I would like to monitor the source and destination connections of each ...
2
votes
0answers
1k views
Using burp suite, how can I intercept traffic from one localhost port, but not another one
I have one webapp available on localhost:12345, and another service running on `localhost:6789'. I want to monitor the traffic to/from the webapp (12345), but universally pass the traffic to the ...
2
votes
2answers
8k views
Why are there open ports on my home network router?
It can be a security risk to have unwarranted open ports.
So I ran nmap 192.168.0.1 to investigate if I had open ports on my home network, it turns out, I do:
PORT STATE SERVICE
53/tcp open ...
2
votes
0answers
60 views
Could you attack a port without knowing what service was listening? [duplicate]
A lot of discussion I see suggests that changing default ports for services is just "security by obscurity" and is easily defeated by scanning for open ports.
My question is this, though, if the ...
2
votes
2answers
548 views
Hide logging server from DMZ
I have a server on my DMZ whichs relays syslog and OcsInventory messages to a server on a vlan for logging servers.
In order to allow the packets to go through I must allow port 80 (OcsInventory) and ...
1
vote
3answers
5k views
Why is UDP port scanning slower than TCP port scanning?
I can't seem to find an answer for this.
Any suggestions?
1
vote
3answers
5k views
Does NAT really provide security? [duplicate]
I had an argument with someone on IRC about Network Address Translation. I was under the impression that NAT provided a layer of security to internal networks. I understand that's not the primary ...
1
vote
3answers
1k views
Bibliography of attacks by port scanning techniques
I have to present a paper and make a presentation about the principal types of attacks by port scanning. What literature do you recommend to cover enough information about: types of attacks, port ...
1
vote
2answers
173 views
Do I lose the anonymity of a VPN if they open a port for me?
I currently use a VPN supplier that does not allow for opening ports. They argue that I lose the whole point of a VPN and the anonymity by doing this. I can't see how and they don't seem to be able to ...
1
vote
1answer
154 views
Why is it okay to run NGiNX or Apache Web Server as root on port 80/443 and not your app directly?
Just like the title says, I would like to understand:
what are the implications of running a custom app (like node or flask) on port 80/443.
Is running a reverse proxy like Nginx mandatory from a ...
1
vote
3answers
8k views
What security does an ISP provide for its customers?
I've heard that ISPs provide some kind of protection; using NAT and firewalls, to prevent hackers from using tools such as nmap to attack customers from over the Internet. What other technologies are ...
1
vote
4answers
2k views
SYN scan victim sending back RST
I'm confused on the case of SYN scan and closed ports (the case of open ports makes sense). So, the attacker sends a ~40 byte SYN packet, a "closed port" would send a RST packet back to the attacker ...
