Port 80 listen without WebServer?

hacinn · 06-29-2004, 12:38 PM

Hi,

I have a RedHat/Conectiva 8 and i runned nessus and i received the follow message:

Security Note: Port: www-http ( tcp/80)

But i don't a web server running. I runned the chkrootkit and it doesn't find nothing. The same to Clamav, that doesn't find nothing. The netstat -anp doesn't show port 80 too. But when i run the nmap from other computer, the port 80 is listening.

Anyone can help me?

Thanks

comp12345 · 06-29-2004, 02:04 PM

Try "lsof -i :80"

hacinn · 06-29-2004, 02:28 PM

I runned the command, but it doesn't show nothing.

ppuru · 06-29-2004, 10:32 PM

try

#netstat -pal

Gives you a list of active ports and the services that are listening on them.

Also, run

#tcpdump dst port 80

This will list any activity on port 80 of your system.

hacinn · 06-30-2004, 09:47 AM

I ran this commands, but the result doesn't show port 80.

ppuru · 06-30-2004, 09:52 PM

please post the entire output of nessus wrt the port 80 Security Note.

also, telnet to port 80 from another system and let us know the output.

You can try

#telnet <ip> 80

When the service responds,

get /

when telnet waits for a response.

OR, try connecting from a browser.