I have a process that I'm running on my local machine which is listening on TCP port 9000. I would like to consume on another computer of my network. Here is my configuration:
I would like to see it when I run nmap 10.18.12.12 but I don't know how.
nmap localhost
Starting Nmap 6.47 ( http://nmap.org ) at 2015-08-20 13:49 ART
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00037s latency).
Other addresses for localhost (not scanned): 127.0.0.1
Not shown: 987 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
80/tcp open http
111/tcp open rpcbind
443/tcp open https
631/tcp open ipp
3306/tcp open mysql
5432/tcp open postgresql
8000/tcp open http-alt
**9000/tcp open cslistener**
9001/tcp open tor-orport
9999/tcp open abyss
Starting Nmap 6.47 ( http://nmap.org ) at 2015-08-20 13:45 ART
Nmap scan report for 10.18.12.12
Host is up (0.00073s latency).
Not shown: 994 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open http
111/tcp open rpcbind
443/tcp open https
3306/tcp open mysql
The service is bound to 127.0.0.1. You can see this without using Nmap; use netstat instead: netstat -tln will show all listening TCP ports. You should see something like this:
$ netstat -tln
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:9000 0.0.0.0:* LISTEN
In this example, the service on port 21 (FTP) is listening on the special address 0.0.0.0 which means "any available address," but the service on port 9000 is bound to 127.0.0.1, which is a special address ("localhost" or "loopback") not accessible from the network.
Most services will have a way to specify which addresses or interfaces to listen on. Read the manual for the service you are interested in to determine how to change this.
Related
I have my Windows server 2012 which is active on production and running 2 websites of .NET. Now I want to run my wordpress site I had configured everything and my wordpress site was working fine before but all of sudden now am unable to connect to local host and even wp admin dashboard is not appearing so I deleted all that stuff uninstalled MYSQL connector MYSQL and web platform installer too. Even now I'm facing the same problem.
Whenever I try to connect 127.0.0.1 /Localhost I get the same message for both "This site can't be
reached" and if I try to connect with my public ip it says "HTTP Error 404. The requested resource is not found."
My netstat results are mentioned below:
C:\Users\Administrator>netsh http show iplisten
IP addresses present in the IP listen list:
173.208.205.34
173.208.205.35
173.208.205.36
C:\Users\Administrator>netstat -ano
Active Connections
1. Proto Local Address Foreign Address State
PID TCP 0.0.0.0:135 0.0.0.0:0
LISTENING
1192 TCP 0.0.0.0:180 0.0.0.0:0
LISTENING 1388 TCP 0.0.0.0:445 0.0.0.0:0
LISTENING 4 TCP 0.0.0.0:1433 0.0.0.0:0
LISTENING 2812 TCP 0.0.0.0:1443 0.0.0.0:0
LISTENING 1388 TCP 173.208.205.34:80 0.0.0.0:0
LISTENING 4 TCP 173.208.205.34:139 0.0.0.0:0
LISTENING 4 TCP 173.208.205.34:443 0.0.0.0:0
LISTENING 4 TCP 173.208.205.34:443
160.153.147.141:35160 TIME_WAIT 0
TCP 173.208.205.34:1433 122.176.28.110:2048 ESTABLISHED 28
Additionally, I have checked the etc/hosts file it have 127.0.0.1 localhost uncommented there.
I have also disabled the firewall that make no change.
Can anyone tell what is wrong with this ?
I notice that there is no 0.0.0.0:80 in the IP listen list. Does your site bind to localhost:80?
The correct IP address in list should include
0.0.0.0:80 (ipv4) and [::]:80 (ipv6)
I think you can add 127.0.0.1 to IP listen list.
netsh http add iplisten ipaddress=127.0.0.1
Then check whether it is in list.
I am running my node server on ubuntu with sudo node index.js
Running curl http://localhost/health-check gives a response but if I use the public IP, it does not get any response
Running sudo netstat -ntlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
59739/node
Running nmap -A -T4 myDomainName
Starting Nmap 7.01 ( https://nmap.org ) at 2017-11-22 12:32 UTC
Nmap scan report for myDomainName (IP address)
Host is up (0.0011s latency).
Not shown: 997 filtered ports
PORT STATE SERVICE VERSION
...
80/tcp closed http
443/tcp closed https
Running nmap localhost
Starting Nmap 7.01 ( https://nmap.org ) at 2017-11-22 12:28 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000062s latency).
Not shown: 997 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
Lastly sudo ufw status
To Action From
-- ------ ----
22 ALLOW Anywhere
80 ALLOW Anywhere
443 ALLOW Anywhere
80/tcp ALLOW Anywhere
22 (v6) ALLOW Anywhere (v6)
80 (v6) ALLOW Anywhere (v6)
443 (v6) ALLOW Anywhere (v6)
80/tcp (v6) ALLOW Anywhere (v6)
Port 80 is open on localhost but not open on the domain name/ public ip
For my own sanity, does anyone know why rpcbind (linux) is opening a seemingly random port every time it's restarted? I know it uses port 111, but what is this other port that keeps opening up with it? Thanks.
[root#testmachine ~]# nmap -sU -p 0-65535 127.0.0.1
Starting Nmap 5.51 ( http://nmap.org ) at 2016-03-03 16:00 EST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000080s latency).
Not shown: 65533 closed ports
PORT STATE SERVICE
111/udp open|filtered rpcbind
819/udp open|filtered unknown
Nmap done: 1 IP address (1 host up) scanned in 3.11 seconds
[root#testmachine ~]# service rpcbind restart
Stopping rpcbind: [ OK ]
Starting rpcbind: [ OK ]
[root#testmachine ~]# nmap -sU -p 0-65535 127.0.0.1
Starting Nmap 5.51 ( http://nmap.org ) at 2016-03-03 16:00 EST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000080s latency).
Not shown: 65533 closed ports
PORT STATE SERVICE
111/udp open|filtered rpcbind
846/udp open|filtered unknown
Nmap done: 1 IP address (1 host up) scanned in 2.97 seconds
[root#testmachine ~]# service rpcbind restart
Stopping rpcbind: [ OK ]
Starting rpcbind: [ OK ]
[root#testmachine ~]# nmap -sU -p 0-65535 127.0.0.1
Starting Nmap 5.51 ( http://nmap.org ) at 2016-03-03 16:05 EST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000070s latency).
Not shown: 65533 closed ports
PORT STATE SERVICE
111/udp open|filtered rpcbind
892/udp open|filtered unknown
Nmap done: 1 IP address (1 host up) scanned in 2.86 seconds
More than likely, it's an RPC service. Try the rpcinfo command to see what it is.
Unlike most other network services (FTP, HTTP, SMTP, etc), RPC services are bound to dynamic ports. Instead of connecting directly to the server, an RPC client first sends a request to the RPC port mapper (UDP/111 by default) to find out what port the server is on (a similar is used on Windows).
On a related note, nmap is great, but there are much easier ways to learn about the listening ports on your computer. Try this instead: sudo netstat -anp | grep LISTEN. It's much faster and will even give you the process name and number.
Also, nmap 5.51 is about five years old now. If you use it often, it's worth upgrading to get some new features.
The Debian man page for rpcbind tells me that:
All RPC servers must be restarted if rpcbind is restarted.
The OP didn't mention that they'd done that, so how would any of the RPC services have reregistered? Imagine my surprise, then, on repeating the OP's experiment and applying the rpcinfo -p suggestion from #SArcher to see that all the RPC services were still registered... and on their original ports, suggesting that #SArcher wasn't quite on the money.
If, however, we also apply the other great suggestion from #SArcher, namely to sudo netstat -anp, we get something more interesting. Now we can't |grep LISTEN as suggested because the OP's post says udp and UDP sockets are never in state LISTEN. What we do find is that rpcbind doesn't just have sockets on port 111 - its job - but also another "reserved" port picked seemingly at random when rpcbind starts, just as the OP says.
So "what is this other port for?" you ask. Sorry to tease but I just answered that in my description of:
Debian bug 870579: rpcbind callit replies from a random reserved udp port, making firewalling hard
On redhat there is a separate service called rpcbind.socket. This gets started with rpcbind.service. rpcbind.service first checks if port 111 is available, if it is not available then it chooses a port and starts listening on that port.
In redhat the rpcbind.socket is started first and it startes using port 111. In netstat the port 111 will be displayed as used by systemd. When rpcbind is started it finds that port 111 is already used by systemd and hence it chooses a different port. If you mask the rpcbind.socket service and then start rpcbind.service, rpcbind will start listening on port 111.
I have a:
Rasberry Pi 2
running
Raspbian Jessie Version:November 2015
I am using Undertow (a Java http server) to serve a website. This is the code that I use to build the server.
Undertow server = Undertow.builder()
.addHttpListener(8890, "localhost")
.setHandler(Handlers.pathTemplate()
.add("/", resource(new PathResourceManager(staticFilePath, 100))
.setDirectoryListingEnabled(false))
.build();
Problem: I am unable to see the webserver from another machine on the local network despite being able to ping and SSH into the PI.
What I have done (on the Pi2):
wget localhost:8890
returns the index.html correctly
netstat -lptn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp6 0 0 :::22 :::* LISTEN -
tcp6 0 0 127.0.0.1:8890 :::* LISTEN 1743/java
Chrome on my development machine 192.168.1.8:8890 gives
ERR_CONNECTION_REFUSED
wget 192.168.1.8:8890
Connecting to 192.168.1.8:8890... failed: Connection refused.
nmap 192.168.1.8
Starting Nmap 6.40 ( http://nmap.org ) at 2015-12-05 14:05 CST
Nmap scan report for 192.168.1.8
Host is up (0.039s latency).
Not shown: 999 closed ports
PORT STATE SERVICE
22/tcp open ssh
Nmap done: 1 IP address (1 host up) scanned in 1.83 seconds
It is my understanding that there is no firewall so I am baffled as to why I can't see the server from my development machine.
See:
tcp6 0 0 127.0.0.1:8890 :::* LISTEN 1743/java
Your web server listens only on localhost address (127.0.0.1). This way it couldn't be accessed from anywhere but localhost.
And your nmap scan shows the same: the only remotely accessible port is 22.
To access this service remotely you have to bind web server to any non-local address belonging to this raspberry pi (192.168.1.8) or to "any address" 0.0.0.0, as SSH service is bound.
How to do this is written in the manual of your web server. Probably, you have to start is with a "-d" param, i.e.
standalone.sh -b=0.0.0.0
standalone.sh -Djboss.bind.address=0.0.0.0
or something like this.
In listener setup code this looks like
"localhost" have to be replaced with some public name. This could be "0.0.0.0" or "192.168.1.8". We also can
cat "192.168.1.8 somename" >> /etc/hosts
and then use somename:
Undertow server = Undertow.builder() .addHttpListener(8890, "somename")
I have a vm in vmware workstation, it's bridged network and DHCP. The IP assigned by DHCP server is 10.21.245.22. Here is my /etc/hosts looks like:
127.0.0.1 hadoop-namenode-01 localhost
I am running command A and B on the box itself.
Command A:
root#hadoop-namenode-01:~# nmap -sT -sU -p- localhost
Starting Nmap 5.21 ( http://nmap.org ) at 2012-08-10 09:32 PDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00029s latency).
rDNS record for 127.0.0.1: hadoop-namenode-01
Not shown: 131058 closed ports
PORT STATE SERVICE
22/tcp open ssh
53/tcp open domain
631/tcp open ipp
8020/tcp open unknown
9000/tcp open cslistener
9001/tcp open tor-orport
50070/tcp open unknown
53/udp open|filtered domain
68/udp open|filtered dhcpc
123/udp open ntp
5353/udp open|filtered zeroconf
47982/udp open|filtered unknown
Nmap done: 1 IP address (1 host up) scanned in 12.45 seconds
Command B:
root#hadoop-namenode-01:~# nmap -sT -sU -p- 10.21.245.22
Starting Nmap 5.21 ( http://nmap.org ) at 2012-08-10 09:28 PDT
Nmap scan report for wn7x64-3jql0q1.dub.emea.dell.com (10.21.245.22)
Host is up (0.00029s latency).
Not shown: 131065 closed ports
PORT STATE SERVICE
22/tcp open ssh
68/udp open|filtered dhcpc
123/udp open ntp
5353/udp open|filtered zeroconf
47982/udp open|filtered unknown
Nmap done: 1 IP address (1 host up) scanned in 12.20 seconds
My question is :
since I have no firewall or anything like that blocking ports, why nmap shows more ports open when it's running against localhost while less ports are shown when it's running against the ip.
why nmap shows more ports open when it's running against localhost
while less ports are shown when it's running against the ip
Some applications decided to explicitly listen (bind actually) only on localhost, i.e. 127.0.0.1. You can do a netstat to check things out.
Most of system running process in Linux use loopback (127.0.0.1) ip address to communicate with each other. It doesn't require to send packet outside network.