Port open but not accessible from outside

RHCE_ran · 12-03-2013, 02:56 AM

I wanted to understand a certain behavior towards accessing a port on our RHEL 5X servers. The local IP of the server is 10.101.17.80 and when I do:

netstat -tupln | grep 1399

it shows that the port is open.

But, when I try to access from another machine with local IP 10.101.17.79 on the same VMware setup
like:

telnet 10.101.17.80 1399

it says connection refused. There is no IPTABLES restriction also.

I hope my question is clear.

Please revert with the reply to my query.

Regards

Zyblin · 12-03-2013, 03:59 AM

https://en.wikipedia.org/wiki/Open_port

Quote:

...Technically, a given port being "open" (in this context, reachable) is not enough for a communication channel to be established. There needs to be an application (service) listening on that port, accepting the incoming packets and processing them. If there is no application listening on a port, incoming packets to that port will simply be rejected by the computer's operating system.

RHCE_ran · 12-03-2013, 04:12 AM

Thanks a ton for your reply. So, does it mean that the usual port 80 is served by the httpd application and we can connect to the machine like,

telnet <IP> 80?

Request a revert so that it can clear the concepts in totality.

Zyblin · 12-03-2013, 04:20 AM

Here is a link and the info from that link that may help you a little more with port 80. They talk about two things here that don't apply to your question, their firewall test and Microsoft. Just ignore that part ;-)

http://www.auditmypc.com/tcp-port-80.asp

Quote:

TCP 80

TCP Port 80 may use a defined protocol to communicate depending on the application. A protocol is a set of formalized rules that explains how data is communicated over a network. Think of it as the language spoken between computers to help them communicate more efficiently.

Protocol HTTP for example defines the format for communication between internet browsers and web sites. Another example is the IMAP protocol that defines the communication between IMAP email servers and clients or finally, the SSL protocol which states the format to use for encrypted communications.
TCP Port 80

Here is what we know about protocol TCP Port 80. If you have information on TCP port 80 that is not reflected on this page, simply leave a comment and we’ll update our information.

PORT 80 is the default port used by Hypertext Transfer Protocol. When you visit a website, it serves your browser information over port 80. Unfortunately, because it’s so popular, it is also used by a number of viruses.

If you scanned your computer with our free firewall test and see that port 80 is open, and you have not set an application to use and listen on that port, then you may have a virus. What you need to do open your browser, type in your ip address and see what pops up? You can also install this free tool from Microsoft to check for open ports.

PORT 80 – More Information

Port Number: 80
TCP / UDP: TCP
Delivery: Yes
Protocol / Name: [Malware known as WebServerCT]
Port Description: [malware info: Web Server CT]
Virus / Trojan: Yes, Caution!
Use our free Digital Footprint and Firewall Test to help verify you are not infected.

Side note: TCP port 80 uses the Transmission Control Protocol. TCP is one of the main protocols in TCP/IP networks. Whereas the IP protocol deals only with packets, TCP enables two hosts to establish a connection and exchange streams of data. TCP guarantees delivery of data and also guarantees that packets will be delivered on port 80 in the same order in which they were sent. Guaranteed communication over port 80 is the key difference between TCP and UDP. UDP port 80 would not have guaranteed communication in the same way as TCP.

Because protocol TCP port 80 was flagged as a virus (colored red) does not mean that a virus is using port 80, but that a Trojan or Virus has used this port in the past to communicate.

cliffordw · 12-04-2013, 01:23 AM

Hi,

Just in case you're still struggling, a few quick questions / suggestions:

* You mention the port, but not the protocol. I trust this is TCP. If UDP (or anything else), telnet won't connect to it
* Have you tried this test from the SAME machine, to eliminate the possibility of a problem on the other machine, or between them?
* Any TCP wrappers at play?

Good luck!

wstewart90 · 12-05-2013, 02:53 AM

Can the VMs ping eachother at all and can you verify that your system isn't actually listening to port 1399 on the loopback address?(i.e., 127.0.0.1)

RHCE_ran · 12-05-2013, 04:01 AM

Thanks for your reply. I did try a self telnet, the machine IP was 10.101.17.80 and I did:

telnet 10.101.17.80

it works but how to check if the system is not listening to port 1399 on the loopback address, I mean what should be the command.

I hope, my query is clear. Requesting a revert.

chrism01 · 12-12-2013, 09:12 PM

Try

Code:

netstat -tanp |grep 1399
netstat -uanp |grep 1399