23

Is there a reason this port is open, a quick Nmap scan and Nessus scan reveal it's open, why?

Are there any ramifications if I close this port via the firewall rule set?

Or does anyone here now more info about this port besides Google?

WTF? 1)http://www.symantec.com/connect/blogs/who-left-tunnel-door-open-windows-firewall-vista-0 I know the talk is about Vista, but I am pretty sure it's the same port on 7, also.

2)Port 5357 common errors:The port is vulnerable to info leak problems allowing it to be accessed remotely by malicious authors. (Web Services for Devices)

I am blocking this crap, if I have issues will just re-enable. Damn windows.

Inbound rule for Network Discovery to allow WSDAPI Events via Function Discovery. [TCP 5357] You just got blocked, until I break something, will see.

Time to re-Nmap and re-Nessus. Nmap scan 0 open ports after closing Port 5357,Win7 still works for now, one more scan with Nessus just to make sure all is well.

1
  • 3
    "Damn windows" :)
    – lepe
    Jul 8, 2015 at 4:33

2 Answers 2

27

This port is opened probably because you have Network Discovery enabled in a Public Network profile.

To make sure if this is the case, don't block it and disable Network Discovery for any public profile you may have.

  • Go to Control Panel\Network and Internet\Network and Sharing Center\Advanced sharing settings
  • Disable Network Discovery on your Home Network and Public Network
  • (Not sure if you need a reboot)
  • Check your ports again. Should not be opened.
  • Enable it in your Home Network and leave it off in your Public Network.

If you are using Windows Firewall it will be correctly mapped and it won't accept connections from outside. Only from within your home network. If you are using a personal firewall, make sure it has port level access so that you can set it up to only accept incoming/outgoing connections from/to your home network.

2
  • 2
    Thanks, did not think about using the Control Panel, I was just thinking ports open...firewall...block open ports. That's some good info to know, I will use this method on my laptop also.
    – Registered
    Oct 18, 2009 at 3:04
  • is there a way to do this with CLI ? cmd or powershell? Aug 20, 2018 at 15:12
0

Just block it in firewall:

secpol.msc
Windows firewall with advance security
inbound rules
add port 5357 block all

my tiny-wall not block this port so this is global setting not overwrite by other

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .