3

i ran this command netstat -apne --inet

and apart from smtp, https, http, i had these ports open

tcp        0      0 xx.xx.xx.xx:48641         yyy.yyy.yyy.yyy:80             TIME_WAIT   0          0          -
tcp        0      0 xx.xx.xx.xx:48643         yyy.yyy.yyy.yyy:80             TIME_WAIT   0          0          -
tcp        0      0 xx.xx.xx.xx:49910         xx.xx.xx.xx:80            TIME_WAIT   0          0          -
tcp        0      0 xx.xx.xx.xx:49911         xx.xx.xx.xx:80            TIME_WAIT   0          0          -
tcp        0      0 xx.xx.xx.xx:49899         xx.xx.xx.xx:80            TIME_WAIT   0          0          -
tcp        0      0 xx.xx.xx.xx:49902         xx.xx.xx.xx:80            TIME_WAIT   0          0          -
tcp        0      0 xx.xx.xx.xx:49900         xx.xx.xx.xx:80            TIME_WAIT   0          0          -
tcp        0      0 zzz.zzz.zzz.zzz:51950         zzz.zzz.zzz.zzz:80            TIME_WAIT   0          0          -
tcp        0      0 xx.xx.xx.xx:33003         zzz1.zzz1.zzz1.zzz1:80              TIME_WAIT   0          0          -

(server ip = xx.xx.xx.xx, other ips are y's, z's).

what are these ports open for?

1
  • I'd say this is perfectly normal, you just have some open HTTP connections.
    – slhck
    Jun 7, 2011 at 8:08

2 Answers 2

3

You didn't limit your search to "listening" state ports / sockets. Use the "-l" switch to filter. Otherwise, netstat also lists those connections where your machine connected to a listening port of another machine.

tcp  0  0 xx.xx.xx.xx:49899  xx.xx.xx.xx:80   TIME_WAIT   0    0    -

This reads as: xx.xx.xx.xx:49899 (local) is connected to xx.xx.xx.xx:80 (remote) and the connection is in state TIME_WAIT. The "open" ports you are concerned about are the ports that are in state LISTEN, hence a process is waiting for incoming connections on that port.

If you run netstat as root and with the -p switch it will also show you the process id (PID) and name of each process that opened that connection (unless, as in your example, the connection is in state TIME_WAIT, since in that case it is actually closed already).

0

Those ports are just the lingering remains of connections to various web servers (connected to remote port 80) which have been closed, but are hanging around for a time so that they can respond to the remote server's notice that it has successfully closed the connection if it should choose to send such a response. See http://developerweb.net/viewtopic.php?id=2941 if you care about the gory details.

As barbaz said, the important thing here is that these ports are not in a LISTEN state. They are not waiting to accept incoming connection requests, rather they were used to initiate outgoing connections and will refuse to accept data from any remote host other than the one they opened that connection to.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .