1

While executing the command /usr/sbin/lsof -l -i -P -n as the root user, I am getting this output.

COMMAND    PID   USER   FD   TYPE     DEVICE   SIZE/OFF   NODE NAME
...
httpd     9164     70   3u   IPv4   0x2f70270      0t0    TCP 127.0.0.1:9010 (LISTEN)
httpd     9164     70   4u   IPv6   0x25af4bc      0t0    TCP *:80 (LISTEN)
httpd     9164     70   5u   IPv4   0x3149e64      0t0    TCP *:* (CLOSED)
httpd     9180     70   3u   IPv4   0x2f70270      0t0    TCP 127.0.0.1:9010 (LISTEN)
httpd     9180     70   4u   IPv6   0x25af4bc      0t0    TCP *:80 (LISTEN)
httpd     9180     70   5u   IPv4   0x3149e64      0t0    TCP *:* (CLOSED)

What does *:* stand for? I am interested to know both the IP address and port fields. Also, what does (CLOSED) mean here?

1

The digit after : denotes the portnumber of the service.

CLOSED denotes that the particular port is a closed port.

In security parlance, the term open port is used to mean a TCP or UDP port number that is configured to accept packets. In contrast, a port which rejects connections or ignores all packets directed at it is called a "closed port"

Malicious hackers (or crackers) commonly use port scanning software to find which ports are "open" (unfiltered) in a given computer, and whether or not an actual service is listening on that port. They can then attempt to exploit potential vulnerabilities in any services they find.

  • 1
    Your answer would be more useful if you explained why the operating system would maintain status information for a closed port. – Scott Oct 23 '13 at 21:58
1

The * indicates 'All Addresses' or 'All Ports'. *:* means 'All ports from any address', so any computer connecting to any port will match that predicate.

*:80 means "all addresses for this server, on port 80", so if you had two NICs, using two different IP addresses (and using IPv6), the service on port 80 would listen on both those interfaces, and the loopback, and would respond to all connections to 80 from any address. You can think of * for IPv4 addresses as meaning '0.0.0.0/0' (any address on the internet). By contrast, the LISTENING service for port 9010 will only accept packets from 127.0.0.1 (localhost).

  • netstat uses the same convention. – Scott Oct 25 '13 at 18:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.