[arch-general] Port 80 is shown open in port scan without any web server running

[Simon Perry]

 On Wed, 30 Mar 2011 14:06:48 +0530, Partha Chowdhury wrote:

> Output from lsof:
>> sudo /bin/lsof -i
>> COMMAND    PID   USER   FD   TYPE DEVICE SIZE NODE NAME
>> pdnsd     1207 nobody    4u  IPv4   2434       TCP localhost:domain 
>> (LISTEN)
>> pdnsd     1207 nobody    5u  IPv4   2435       UDP localhost:domain
>> pdnsd     1207 nobody    8u  IPv4  81232       UDP 
>> 172.16.37.164:40131->AS-20144-has-not-REGISTERED-the-use-of-this-prefix:domain
>> linc      1214   root    5u  IPv4   2448       UDP *:55089
>> ntpd      1216   root   16u  IPv4   2451       UDP *:ntp
>> ntpd      1216   root   17u  IPv4   2455       UDP localhost:ntp
>> ntpd      1216   root   18u  IPv4   2456       UDP 172.16.37.164:ntp
>> X         1377   root    1u  IPv4   2964       TCP *:x11 (LISTEN)
>> gweather- 1538 partha   18u  IPv4  78973       TCP 
>> 172.16.37.164:53421->a125-56.222-11.deploy.akamaitechnologies.com:http 
>> (CLOSE_WAIT)

 I think you're confused.

 That's essentially a netstat, I can't see where you have 80 open on 
 your IP of 172.16.37.164.

 It just shows you have a connection *to* port 80 to an Akamai host (a 
 common provider of localised content used by many companies).

-- 
 Simon Perry (aka Pezz)
 [ s a n x i o n . n e t ]