0

There is an active ufw on a linux-pc. The output from nmap -sT -O localhost is:`

Starting Nmap 6.40 ( http://nmap.org ) at 2019-05-27 22:59 EEST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00019s latency).
All 1000 scanned ports on localhost (127.0.0.1) are closed
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port` ...

The output from netstat -tupln is:

(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.1.1:xxx           0.0.0.0:*               LISTEN      -               
udp        0      0 0.0.0.0:8716            0.0.0.0:*                           -               
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           -               
udp        0      0 0.0.0.0:36678           0.0.0.0:*                           -               
udp        0      0 127.0.1.1:xxx           0.0.0.0:*                           -               
udp        0      0 0.0.0.0:xxx             0.0.0.0:*                           -               
udp6       0      0 :::5353                 :::*                                -               
udp6       0      0 :::5635                 :::*                                -               
udp6       0      0 :::49355                :::*                                -               

So, if all 1000 ports are closed how the pc connects to the internet ( because it is connected )? And if port xxx on the localhost is LISTEN-ing why nmap can't detect it?

What is the difference between the ports of the localhost and the ports of the ... eth0?

Are there 65535 ports for the localhost and other 65535 ports for the eth0 network-interface?

1 Answer 1

0

So, if all 1000 ports are closed how the pc connects to the internet ( because it is connected )? And if port xxx on the localhost is LISTEN-ing why nmap can't detect it?

When you connect to some remote site, the local program opens a socket against the server, identified by the local port, remote port and the remote IP. It will not receive packets not matching this tuple.

The local port is typically selected from the ephemeral ports. Those are not scanned by nmap by default, and would not show up either, as nmap doesn't match the tuple for the socket.

What nmap looks for is open sockets, accepting connections. According to nmap you have one, but you have masked it, so we don't know if nmap checks that port. There's 65535 ports, but by default nmap only scans about 1000 of them.

What is the difference between the ports of the localhost and the ports of the ... eth0?

Things listening on 127.0.0.1 will only receive packets on the loopback interface. Things listening on 0.0.0.0 or a specific device will receive packets either from all (0.0.0.0) or on that specific device.

Are there 65535 ports for the localhost and other 65535 ports for the eth0 network-interface?

Yes, and no. A connection consists of the tuple local port, remote port, remote IP and possibly local IP. You can have different services listening on the same port on two different IP's.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .