1

We have a virtual system running Windows Server 2008 R2, and it responds on TCP port 7 (echo). (I.e, in response to a SYN it sends ACK,RST, which is enough to make InetAddress#isReachable() return true.)

However, this system does not have the 'Simple TCP/IP services' feature enabled. And checking netstat -a, there is nothing listening on port 7.

So who is responding to the TCP echo requests?

Note that a physical Windows 7 system, which also does not have 'Simple TCP/IP services' enabled, does not respond (as expected). And switching on that feature and starting the corresponding Windows service makes netstat -a show

  TCP    0.0.0.0:7              WINDOWS7HOSTNAME:0      LISTENING

(again: as expected).

As far as we've seen now, our Windows Server 2008 / 2008 R2 systems (which are all virtual) respond unexpectedly, and the Windows 7 systems (which are all physical and don't have 'Simple TCP/IP services' enabled) do not respond, as expected.

My question: why does a virtual system running Windows Server respond on TCP echo port 7, without 'Simple TCP/IP services' enabled?

Could this be caused by the virtualization software (which I think is VMware ESX)? Or is this a feature in Windows Server editions? What other cause could there be?

1

This is completely normal and expected. When you try to connect to a TCP port that has nothing listening on it, the server always responds with a "reset" packet (having the RST flag). This is documented in RFC 793 page 65, Transmission Control Protocol: Protocol Specification:

SEGMENT ARRIVES

    If the state is CLOSED (i.e., TCB does not exist) then

      all data in the incoming segment is discarded.  An incoming
      segment containing a RST is discarded.  An incoming segment not
      containing a RST causes a RST to be sent in response.  The
      acknowledgment and sequence field values are selected to make the
      reset sequence acceptable to the TCP that sent the offending
      segment.

      If the ACK bit is off, sequence number zero is used,

        <SEQ=0><ACK=SEG.SEQ+SEG.LEN><CTL=RST,ACK>

      If the ACK bit is on,

        <SEQ=SEG.ACK><CTL=RST>

      Return.

However, many firewalls, including the one that comes with Windows, are configured to drop all packets that the firewall does not recognize – the so-called "stealth mode". So the Win7 firewall drops your connection request before it even reaches the TCP driver, since it does not have a rule to accept TCP port 7 connections.

(Which is the most annoying thing ever, might I add. Instead of a simple "nothing here, go away" it causes long, annoying timeouts.)

On your Windows Server, TCP responds as intended, since the firewall is either inactive or not configured to block this port.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.