Based on this answer, I tried to close an open port, the problem is that nmap says that there are 5 open ports, but lsof says there is no current process using those ports, so my question is how can I close those.

This is the output from nmap

Nmap scan report for
Host is up (0.022s latency).
Not shown: 995 closed ports
80/tcp    open  http
5000/tcp  open  upnp
49153/tcp open  unknown
49154/tcp open  unknown
50000/tcp open  ibm-db2

and when I try every lsof -i:port they print nothing.

I also tried netstat -apn | grep ':port' to see the process attached to the port, but there was no output.


Yes, my computer is


I'm running ubuntu 16.04. I didn't install XAMP or any local servers (maybe ubuntu comes with one of it?), but the port 80 may be used because of chromium. But I don't have any idea where those other 4 ports come from and I would really like to close them.

I did disable upnp by going to>Administration->upnp->disable->save changes (on a cisco router). But if I restart the router upnp keeps enabling it. And if for disabling upnp one has not the need to restart the router, then nmap shows open ports which are not really opened. The output of nmap is the same after changing upnp.

  • 1
    You have a router with upnp, disable upnp, then perform the scan again. – Ramhound Jun 22 '17 at 0:13
  • Did you run the lsof -i:port command as root? If the Apache httpd process was listening on port 80, but you ran the command lsof -i:80 from your user account, you wouldn't see any output, if Apache was running under its own account rather than your user account. – moonpoint Jun 22 '17 at 1:37
  • @moonpoint Yes, I runed them as root. – Garmekain Jun 22 '17 at 1:38
  • 6
    Are you sure the ports are really open, and it's not just nmap acting up? Try to use telnet to connect to the specified ports, see if it works. That's an easy way to verify if a TCP port is accepting incoming connections. – Guillaume Boudreau Jun 23 '17 at 1:06
  • You could specifically block these ports in the router. – harrymc Jun 26 '17 at 8:03

If netstat & lsof (as root) report no processes attached to those ports, there is very little you can do beyond that.

If nmap is reporting them as open and (rightly) assuming nmap is reliable in this, it leaves a mystery on our hands. From your posts it also appears that you may not have made a mistake in your observations (no offense, just ruling out human error).

Applying the Sherlock Holmes adage "if we eliminate the impossible, whatever remains, however improbable, must be the truth", I would theorize that:

  • nmap is indeed finding a host that responds to (could be a coincidence, but a.b.c.15 is the default IP address used by VirtualBox for NATTed guests).
  • that host is not your Ubuntu system/VM

If this line of thinking is right, you might want to look for another system with that IP address that is reachable from the host where you're running nmap. You will find it in the arp table right after you run nmap or ping. Use it to confirm the possibilities.

Aside (from one of your comments): Using Chromium should not open port 80 in listen mode (in any mode at all) on any system. If it is, for any reason, it would be reported on lsof -i or netstat -nltp.

  • I've checked again, and I didn't remember I resetted the router, so local IPs of my devices changed, so yes, was NOT my computer, it was actually an amplifier, which has wifi (who knew?). This was checked by telneting that client, and in the server info what I saw was the model of the amplifier(googling it). Thanks for this insightful response, though. – Garmekain Jun 28 '17 at 16:49
  • Happy to have been of help. Sometimes troubleshooting can be very vexing. Every small hint helps. :) – Sas3 Jun 28 '17 at 18:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.