As this Wikipedia article explains (see also this article), LDP is primarily used by routers. Therefore, it seems likely that it's your router (or perhaps your cable/DSL/ISDN modem), which provides the gateway between the computer(s) on your local network and the Internet, that is running a server on port 646.
How to Find Out
To check, use
ifconfig to find out your Ubuntu system's LAN IP, and then use nmap to scan your own machine on that interface. (Please note that you will often, but not necessarily, have the same services running on the loopback interface--through which your machine can communicate with itself with the IP address
127.0.0.1 or the domain
localhost--as on your physical interface.)
nmap if you don't have it installed, either by clicking the link above (it will install in the Software Center), or by running these commands in a Terminal window (Ctrl+Alt+T):
sudo apt-get update
sudo apt-get -y install nmap
ifconfig to find your LAN IP address. If you run it just like that, it will list the IP addresses on all your network interfaces. If you know which interface is your LAN interface (the one that connects to your router, switch, wireless access point, or cable/DSL/ISDN modem), you can supply that as an argument to
ifconfig. In particular:
- If your LAN interface is wired Ethernet, it is usually called
eth0, especially if it's the only Ethernet port on your computer. So you'd run
- If your LAN interface is wireless (WiFi), it is usually called
wlan0, especially if it's the only wireless card on your computer (and it's quite rare, though not unheard of, to have more than one wireless card). So you'd run
Find your IP address (specifically, your IPv4 address, as you're probably not connecting to the Internet via IPv6). It's stated after
inet addr: in the output of
ifconfig. For example, I ran
ifconfig wlan0 and got the following output:
wlan0 Link encap:Ethernet HWaddr 00:14:d1:e9:ce:ec
inet addr:192.168.1.106 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::214:d1ff:fee9:ceec/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:4267147 errors:0 dropped:0 overruns:0 frame:0
TX packets:1561998 errors:0 dropped:0 overruns:0 carrier:0
RX bytes:1780239440 (1.7 GB) TX bytes:202924065 (202.9 MB)
nmap to scan your own machine, from itself, on the LAN interface, efficiently (
-sS) and with service/version detection (
-sV), on port 646 (
-p646), with extra verbose output (
sudo nmap -sS -sV -vv -p646 192.168.1.106
192.168.1.106 with your own LAN IP address, of course.
Examine the output to see the port's status. This is TCP, so there are three possibilities:
- Open. A server is listening for (and presumably accepting) connections on this port. It's very likely an LDP server is running on your machine.
- Closed. No server is listening on this port. It's very unlikely an LDP server is running on your machine.
- Filtered. This port is not responding to attempts to determine whether or not it is open. This almost always means it's firewalled, and since you're scanning from the computer itself, it's a software firewall. (Or you entered the wrong IP address.) By default, ports on Ubuntu systems do not appear filtered.
- However, from the Internet, some, and perhaps almost all of your ports, are filtered. This is what green means on GRC.com's port scan. "Stealth," as the term is used on that site, is essentially a synonym of "Filtered" as
nmap uses it.
- It's not Ubuntu making them appear filtered on the Internet--rather, it's your router (or, in rare cases, a hardware firewall that is not a router). If you connect to the Internet through a NAT router, then machines on the Internet--including the machine at GRC.com doing the port scan--see your router (and specifically its WAN, or Internet-facing, network interface) rather than your Ubuntu machine or any of the other machines connected through it. DMZ is an exception to this; port forwarding is a narrower, though more common, exception.
The output of your
nmap scan should look something like this:
Starting Nmap 5.21 ( http://nmap.org ) at 2012-08-15 05:14 EDT
NSE: Loaded 4 scripts for scanning.
Initiating Parallel DNS resolution of 1 host. at 05:14
Completed Parallel DNS resolution of 1 host. at 05:14, 0.18s elapsed
Initiating SYN Stealth Scan at 05:14
Scanning 192.168.1.106 [1 port]
Completed SYN Stealth Scan at 05:14, 0.04s elapsed (1 total ports)
Initiating Service scan at 05:14
NSE: Script scanning 192.168.1.106.
NSE: Script Scanning completed.
Nmap scan report for 192.168.1.106
Host is up (0.000096s latency).
Scanned at 2012-08-15 05:14:28 EDT for 0s
PORT STATE SERVICE VERSION
646/tcp closed ldp
Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 0.85 seconds
Raw packets sent: 1 (44B) | Rcvd: 2 (84B)
As you can see, on my machine, port 646 is
If yours says
closed, then the service is running on your router (or similar device), or potentially, on another machine on your local network (and exposed through the router via port forwarding or DMZ). See also NAT.
If yours says
open, then the service is running on your Ubuntu system and probably either directly exposed to the Internet, or, if you have a NAT router (which could be built into your cable/DSL/ISDN modem or wireless access point), exposed to the Internet via port forwarding or DMZ.
However, it's quite unlikely but possible that the service GRC.com's scan is seeing is still not from your Ubuntu system, but rather from another machine on your network or from your router or cable/DSL/ISDN modem.
What to Do
nmap scan said the port is open, then you can edit your question to provide details.
- If you're directly connected to the Internet (which includes being connected directly to a cable/DSL/ISDN modem), and not connected through a router, then you may want to edit the output of
nmap so it doesn't reveal your public IP address.
- One way to know if this is your public IP address is if it's the same as the address GRC.com scanned. This is the easiest way for you to know.
- Another way to know if this is your public IP address is to see if it starts with
n is in the range of
31. If your IP address meets that description, then it's on a private network and probably quite safe to divulge (since we--by which I mean people on the Internet--cannot access your computer using that IP address). But if your IP address is not in one of those ranges, it's likely the IP address with which your computer is addressed on the Internet, and you might not want to divulge that.
nmap scan said the port is closed, then you probably have nothing to worry about ...but you may want to look into why your router is running an LDP server. You may be able to disable LDP in you router's settings. Otherwise, you may want to post about this on a site devoted to IT security, such as this site.
You provided some information after performing the above procedure, indicating that
nmap reveals the port to be closed on your Ubuntu system, but that you don't use a router or hardware firewall. You then said:
So propably my ISP (internet service provider) configuration, provided to their customers, is the one that has something to do with the router LDP server port 646 tcp Stealth Filtered Green status.
Yes, that is probably the case. You could ask your ISP if you are unsure. (There may be other ways to find out, too, but I'm not aware of them. If you're interested, that might still be considered an on-topic question at Security.SE.) Ordinarily I would say that the other possibility is that your cable modem is also a router / wireless access point. However, my understanding is that the Motorola cable modems whose model numbers start with
SB and not
SBG are not also routers, but are just cable modems.