Ubuntu 12.04 www.grc.com ports, all CLOSED, but one port 646 LDP Hidden color green?

Question

I did scan of my computer ports using deafult Ubuntu 12.04 installation, at www.grc.com, all of them are in color gray CLOSED, except for one:

Port 646 LDP (Port Authority Database) its HIDDEN state and in color green.

Should I'll be worried, in terms of security?

Update

Ok, I did sudo nmap -sS -sV -vv -p646 (with my public IP).

Got same results as you. 646/tcp closed ldp

You wrote:

(but you may want to look into why your router is running an LDP server. You may be able to disable LDP in you router's settings)

I use:

-Wired Ethernet connection -I dont use a router -I dont use a hardware firewall -I got cable -I use only Motorola SurfBoard Cable Mothem, model SB5100i

So propably my ISP (internet service provider) configuration, provided to their customers, is the one that has something to do with the router LDP server port 646 tcp Stealth Filtered Green status.

Answer 1

As this Wikipedia article explains (see also this article), LDP is primarily used by routers. Therefore, it seems likely that it's your router (or perhaps your cable/DSL/ISDN modem), which provides the gateway between the computer(s) on your local network and the Internet, that is running a server on port 646.

How to Find Out

To check, use ifconfig to find out your Ubuntu system's LAN IP, and then use nmap to scan your own machine on that interface. (Please note that you will often, but not necessarily, have the same services running on the loopback interface--through which your machine can communicate with itself with the IP address 127.0.0.1 or the domain localhost--as on your physical interface.)

1. First install nmap if you don't have it installed, either by clicking the link above (it will install in the Software Center), or by running these commands in a Terminal window (Ctrl+Alt+T):

   sudo apt-get update
   sudo apt-get -y install nmap
   

2. Run ifconfig to find your LAN IP address. If you run it just like that, it will list the IP addresses on all your network interfaces. If you know which interface is your LAN interface (the one that connects to your router, switch, wireless access point, or cable/DSL/ISDN modem), you can supply that as an argument to ifconfig. In particular:

   • If your LAN interface is wired Ethernet, it is usually called eth0, especially if it's the only Ethernet port on your computer. So you'd run ifconfig eth0.
   • If your LAN interface is wireless (WiFi), it is usually called wlan0, especially if it's the only wireless card on your computer (and it's quite rare, though not unheard of, to have more than one wireless card). So you'd run ifconfig wlan0.

3. Find your IP address (specifically, your IPv4 address, as you're probably not connecting to the Internet via IPv6). It's stated after inet addr: in the output of ifconfig. For example, I ran ifconfig wlan0 and got the following output:

   wlan0     Link encap:Ethernet  HWaddr 00:14:d1:e9:ce:ec  
             inet addr:192.168.1.106  Bcast:192.168.1.255  Mask:255.255.255.0
             inet6 addr: fe80::214:d1ff:fee9:ceec/64 Scope:Link
             UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
             RX packets:4267147 errors:0 dropped:0 overruns:0 frame:0
             TX packets:1561998 errors:0 dropped:0 overruns:0 carrier:0
             collisions:0 txqueuelen:1000 
             RX bytes:1780239440 (1.7 GB)  TX bytes:202924065 (202.9 MB)

4. Use nmap to scan your own machine, from itself, on the LAN interface, efficiently (-sS) and with service/version detection (-sV), on port 646 (-p646), with extra verbose output (-vv):

   sudo nmap -sS -sV -vv -p646 192.168.1.106

   Replace 192.168.1.106 with your own LAN IP address, of course.

5. Examine the output to see the port's status. This is TCP, so there are three possibilities:

   • Open. A server is listening for (and presumably accepting) connections on this port. It's very likely an LDP server is running on your machine.
   • Closed. No server is listening on this port. It's very unlikely an LDP server is running on your machine.
   • Filtered. This port is not responding to attempts to determine whether or not it is open. This almost always means it's firewalled, and since you're scanning from the computer itself, it's a software firewall. (Or you entered the wrong IP address.) By default, ports on Ubuntu systems do not appear filtered.
     • However, from the Internet, some, and perhaps almost all of your ports, are filtered. This is what green means on GRC.com's port scan. "Stealth," as the term is used on that site, is essentially a synonym of "Filtered" as nmap uses it.
     • It's not Ubuntu making them appear filtered on the Internet--rather, it's your router (or, in rare cases, a hardware firewall that is not a router). If you connect to the Internet through a NAT router, then machines on the Internet--including the machine at GRC.com doing the port scan--see your router (and specifically its WAN, or Internet-facing, network interface) rather than your Ubuntu machine or any of the other machines connected through it. DMZ is an exception to this; port forwarding is a narrower, though more common, exception.

   The output of your nmap scan should look something like this:

   Starting Nmap 5.21 ( http://nmap.org ) at 2012-08-15 05:14 EDT
   NSE: Loaded 4 scripts for scanning.
   Initiating Parallel DNS resolution of 1 host. at 05:14
   Completed Parallel DNS resolution of 1 host. at 05:14, 0.18s elapsed
   Initiating SYN Stealth Scan at 05:14
   Scanning 192.168.1.106 [1 port]
   Completed SYN Stealth Scan at 05:14, 0.04s elapsed (1 total ports)
   Initiating Service scan at 05:14
   NSE: Script scanning 192.168.1.106.
   NSE: Script Scanning completed.
   Nmap scan report for 192.168.1.106
   Host is up (0.000096s latency).
   Scanned at 2012-08-15 05:14:28 EDT for 0s
   PORT    STATE  SERVICE VERSION
   646/tcp closed ldp
   
   Read data files from: /usr/share/nmap
   Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
   Nmap done: 1 IP address (1 host up) scanned in 0.85 seconds
          Raw packets sent: 1 (44B) | Rcvd: 2 (84B)

   As you can see, on my machine, port 646 is closed.

   • If yours says closed, then the service is running on your router (or similar device), or potentially, on another machine on your local network (and exposed through the router via port forwarding or DMZ). See also NAT.

   • If yours says open, then the service is running on your Ubuntu system and probably either directly exposed to the Internet, or, if you have a NAT router (which could be built into your cable/DSL/ISDN modem or wireless access point), exposed to the Internet via port forwarding or DMZ.

     However, it's quite unlikely but possible that the service GRC.com's scan is seeing is still not from your Ubuntu system, but rather from another machine on your network or from your router or cable/DSL/ISDN modem.

What to Do

If the nmap scan said the port is open, then you can edit your question to provide details.

• If you're directly connected to the Internet (which includes being connected directly to a cable/DSL/ISDN modem), and not connected through a router, then you may want to edit the output of ifconfig and nmap so it doesn't reveal your public IP address.
  • One way to know if this is your public IP address is if it's the same as the address GRC.com scanned. This is the easiest way for you to know.
  • Another way to know if this is your public IP address is to see if it starts with 192.168., 10., or 172.n. where n is in the range of 16 to 31. If your IP address meets that description, then it's on a private network and probably quite safe to divulge (since we--by which I mean people on the Internet--cannot access your computer using that IP address). But if your IP address is not in one of those ranges, it's likely the IP address with which your computer is addressed on the Internet, and you might not want to divulge that.

If the nmap scan said the port is closed, then you probably have nothing to worry about ...but you may want to look into why your router is running an LDP server. You may be able to disable LDP in you router's settings. Otherwise, you may want to post about this on a site devoted to IT security, such as this site.

Update

You provided some information after performing the above procedure, indicating that nmap reveals the port to be closed on your Ubuntu system, but that you don't use a router or hardware firewall. You then said:

So propably my ISP (internet service provider) configuration, provided to their customers, is the one that has something to do with the router LDP server port 646 tcp Stealth Filtered Green status.

Yes, that is probably the case. You could ask your ISP if you are unsure. (There may be other ways to find out, too, but I'm not aware of them. If you're interested, that might still be considered an on-topic question at Security.SE.) Ordinarily I would say that the other possibility is that your cable modem is also a router / wireless access point. However, my understanding is that the Motorola cable modems whose model numbers start with SB and not SBG are not also routers, but are just cable modems.