Netstat and open ports

Hi everyone

I have XP Pro SP2 which is fully updated, connected to ADSL via a router. I read an old thread (about 18 months old) on another forum about person X doing a port scan, finding ports 139 and 445 open and then getting into the remote computer to see what was there. He said that there wasn't anything "interesting" and it hadn't been worth the effort. I'm not asking about how he managed to get into the other PC (I know that I'd get some terse comments!) but I'd like to know about checking open ports and closing them. I ran netstat -a and received the following output:

Active Connections

Proto Local Address Foreign Address State
TCP ComputerName:echo ComputerName:0 LISTENING
TCP ComputerName:discard ComputerName:0 LISTENING
TCP ComputerName:daytime ComputerName:0 LISTENING
TCP ComputerName:qotd ComputerName:0 LISTENING
TCP ComputerName:chargen ComputerName:0 LISTENING
TCP ComputerName:epmap ComputerName:0 LISTENING
TCP ComputerName:microsoft-ds ComputerName:0 LISTENING
TCP ComputerName:1045 ComputerName:0 LISTENING
TCP ComputerName:1899 localhost:1898 TIME_WAIT
TCP ComputerName:netbios-ssn ComputerName:0 LISTENING
TCP ComputerName:echo ComputerName:0 LISTENING 0
TCP ComputerName:discard ComputerName:0 LISTENING 0
TCP ComputerName:daytime ComputerName:0 LISTENING 0
TCP ComputerName:qotd ComputerName:0 LISTENING 0
TCP ComputerName:chargen ComputerName:0 LISTENING 0
TCP ComputerName:epmap ComputerName:0 LISTENING 0
UDP ComputerName:echo *:*
UDP ComputerName:discard *:*
UDP ComputerName:daytime *:*
UDP ComputerName:qotd *:*
UDP ComputerName:chargen *:*
UDP ComputerName:snmp *:*
UDP ComputerName:microsoft-ds *:*
UDP ComputerName:isakmp *:*
UDP ComputerName:1025 *:*
UDP ComputerName:1052 *:*
UDP ComputerName:1062 *:*
UDP ComputerName:1234 *:*
UDP ComputerName:1604 *:*
UDP ComputerName:3544 *:*
UDP ComputerName:4500 *:*
UDP ComputerName:ntp *:*
UDP ComputerName:1090 *:*
UDP ComputerName:1900 *:*
UDP ComputerName:ntp *:*
UDP ComputerName:netbios-ns *:*
UDP ComputerName:netbios-dgm *:*
UDP ComputerName:router *:*
UDP ComputerName:1601 *:*
UDP ComputerName:1900 *:*
UDP ComputerName:47393 *:*
UDP ComputerName:echo *:*
UDP ComputerName:discard *:*
UDP ComputerName:daytime *:*
UDP ComputerName:qotd *:*
UDP ComputerName:chargen *:*

whilst netstat -a -n gave me this:

Proto Local Address Foreign Address State
TCP 0.0.0.0:7 0.0.0.0:0 LISTENING
TCP 0.0.0.0:9 0.0.0.0:0 LISTENING
TCP 0.0.0.0:13 0.0.0.0:0 LISTENING
TCP 0.0.0.0:17 0.0.0.0:0 LISTENING
TCP 0.0.0.0:19 0.0.0.0:0 LISTENING
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1045 0.0.0.0:0 LISTENING
TCP 192.168.0.2:139 0.0.0.0:0 LISTENING
TCP [::]:7 [::]:0 LISTENING 0
TCP [::]:9 [::]:0 LISTENING 0
TCP [::]:13 [::]:0 LISTENING 0
TCP [::]:17 [::]:0 LISTENING 0
TCP [::]:19 [::]:0 LISTENING 0
TCP [::]:135 [::]:0 LISTENING 0
UDP 0.0.0.0:7 *:*
UDP 0.0.0.0:9 *:*
UDP 0.0.0.0:13 *:*
UDP 0.0.0.0:17 *:*
UDP 0.0.0.0:19 *:*
UDP 0.0.0.0:161 *:*
UDP 0.0.0.0:445 *:*
UDP 0.0.0.0:500 *:*
UDP 0.0.0.0:1025 *:*
UDP 0.0.0.0:1052 *:*
UDP 0.0.0.0:1062 *:*
UDP 0.0.0.0:1234 *:*
UDP 0.0.0.0:1604 *:*
UDP 0.0.0.0:3544 *:*
UDP 0.0.0.0:4500 *:*
UDP 127.0.0.1:123 *:*
UDP 127.0.0.1:1090 *:*
UDP 127.0.0.1:1900 *:*
UDP 192.168.0.2:123 *:*
UDP 192.168.0.2:137 *:*
UDP 192.168.0.2:138 *:*
UDP 192.168.0.2:520 *:*
UDP 192.168.0.2:1601 *:*
UDP 192.168.0.2:1900 *:*
UDP 192.168.0.2:46085 *:*
UDP [::]:7 *:*
UDP [::]:9 *:*
UDP [::]:13 *:*
UDP [::]:17 *:*
UDP [::]:19 *:*

I have a few questions:

firstly, my port 445 seems to be open so do I need to worry or do anything about it?

second, I had Outlook open when I ran the netstat commands. As far as I know, it uses SMTP and POP3 so why aren't ports 25 and 110 mentioned as being open or "listening"; and

finally, what exactly do the entries such as "ComputerName:discard" and "ComputerName:chargen" mean in the first listing? They "map" directly to 0.0.0.0:9 and 0.0.0.0:19 in the second.

Sorry that this has been such a long post and the nicely tabbed netstat output hasn't been retained. I looked for tags to enclose the netstat outputs but couldn't find any.

Thanks for your time (and patience!).

Assuming you don't have ports 445,139 forwarded on your router they shouldn't be accessible remotely.

As for Outlook it would use SMTP and POP3 when sending/receiving mail, maybe it was not sending/receiving at the time you ran the netstat command.

After some quick googling it seems the chargen and discard entries are protocols intended for testing purposes. Anything sent to the port is thrown away using the discard protocol. The chargen protocol generates random characters and sends them back to the host connecting to the port. I assume its just a way to test if a computer is up/down or can send/receive data?

Hope this helps.

Oh and first post!! :):)

The best principle to use is if you aren't using it, turn it off. The only time you need something listening is if a service is operating as a service that should be accessible over the network. If you see 0.0.0.0 as the address, that is shorthand for the daemon is listening to every NIC/IP address on your system, which is only relevant on systems with multiple IPs...most service configurations will allow you to bind to a specific IP if you so chose...127.0.0.1 is the IP address of the loopback interface, which is shorthand for referencing yourself...it is only reachable by your computer and isn't as large of a risk.

Just a couple of generic pointers:

1) Since you are using XP SP2, use netstat -nab. Much more useful b/c it shows you WHAT program has the port open (and the port and state of the port)...rather than having to guess what program has it open...

2) These are garbage and should never be needed in a normal environment...disable/turn them off:

Quote:

TCP ComputerName:echo ComputerName:0 LISTENING
TCP ComputerName:discard ComputerName:0 LISTENING
TCP ComputerName:daytime ComputerName:0 LISTENING
TCP ComputerName:qotd ComputerName:0 LISTENING
TCP ComputerName:chargen ComputerName:0 LISTENING
TCP ComputerName:echo ComputerName:0 LISTENING 0
TCP ComputerName:discard ComputerName:0 LISTENING 0
TCP ComputerName:daytime ComputerName:0 LISTENING 0
TCP ComputerName:qotd ComputerName:0 LISTENING 0
TCP ComputerName:chargen ComputerName:0 LISTENING 0
UDP ComputerName:echo *:*
UDP ComputerName:discard *:*
UDP ComputerName:daytime *:*
UDP ComputerName:qotd *:*
UDP ComputerName:chargen *:*
UDP ComputerName:echo *:*
UDP ComputerName:discard *:*
UDP ComputerName:daytime *:*
UDP ComputerName:qotd *:*
UDP ComputerName:chargen *:*

3) These are probably not needed and shouldn't be used unless properly configured/locked down (which brings up another question...is your system acting like a router for some odd reason? Think router is also known as RIP...i forget offhand)...

Quote:

UDP ComputerName:snmp *:*
UDP ComputerName:ntp *:*
UDP ComputerName:ntp *:*
UDP ComputerName:router *:*

4) As far as netbios (tcp/139 tcp/445 udp/137-138): Are you sharing a drive/printer from your system to other users on the network? If not, disable your server service. Are you using someone elses drives/printers? If not disable your workstation/computer browser services.

5) Lastly, Blackviper has happily returned, have a look:
http://www.blackviper.com/WinXP/servicecfg.htm

You'll find that as you disable services running in the background, you'll see less programs listening on network connections/ports and you should also find that your system is running faster since you aren't wasting cycles/memory on programs you aren't using...

@ gambL: Thank you - a useful first post (well, I think so!). No, I don't have any port forwarding set in the router. It's logical that neither SMTP nor POP3 was displayed so I got Outlook to Send/Receive and then ran netstat again. The list mentioned POP3 but didn't show it's port. I'll look into this further when I've disabled the "rubbish" (as below).

@nebulus2000: Yes, I've played around with the -b switch and seen the output. I'm interested to see that there are unnecessary entries and I'm keen to disable them ... but how? I haven't (to my knowledge) set the laptop up as a router. It's the only one attached to the ADSL router so I guess that I should also disable the entries that you listed in 3)?

I have had file and printer sharing enabled (when I had another laptop attached via a cross-over cable) so I guess that by disabling that in TCP/IP properties, it should get rid of the netbios-related entries mentioned in 4)?

My system is running a little slowly and I was contemplating reinstalling the OS. Maybe these recommended tweaks will prevent my having to do that (not something I do without good reason!).

I remember looking for Blackviper a while ago - I'll check it out.

Thanks again for the input.

I've been thinking - as I was connected to the internet whilst I ran Netstat to get the outputs which I gave, why isn't there reference to either port 80 or 8080? Does it relate somehow to the fact that I'm behind an ADSL router? I haven't changed any of the router firewall settings. If this is the case, how can I check what ports I have open to the "outside world"? I'm so confused now!

Quote:

Assuming you don't have ports 445,139 forwarded on your router they shouldn't be accessible remotely.

Most routers/switches do forward this traffic, hence, worm propigation...

Quote:

As far as netbios (tcp/139 tcp/445 udp/137-138): Are you sharing a drive/printer from your system to other users on the network? If not, disable your server service. Are you using someone elses drives/printers? If not disable your workstation/computer browser services.

Another way to disable CIFS (port 445) is to disable NetBIOS over TCP by simply clicking a checkbox in the advanced properties of TCP/IP.

Quote:

second, I had Outlook open when I ran the netstat commands. As far as I know, it uses SMTP and POP3 so why aren't ports 25 and 110 mentioned as being open or "listening"

It doesn't matter if the outlook client is open. It matters what the connection state is when you perform netstat. Unless you executed netstat during the time wait period of the mail send/receive, you're not going to see the ports in use. POP3 and SMTP are not running as a service on your host, hence, you're not going to see them in your output all the time. For a better look at what's happening, download a tool called TCPview (google it) and you can watch your system in (almost) realtime rather than snapshotting it with netstat. Or simply click send/receive in outlook then immediately do a netstat. You'll see port 110 in time wait.

Quote:

finally, what exactly do the entries such as "ComputerName:discard" and "ComputerName:chargen" mean in the first listing? They "map" directly to 0.0.0.0:9 and 0.0.0.0:19 in the second

Chargen and discard are legacy services that have virtually no use anymore. Old skoolers like myself remember them fondly from the "80s". Trace route and ping (via ICMP) have long since replaced Chargen and discard. These two protocols were the network testing tools back in the day.

Turn them off. They can only lead to trouble.

Quote:

These are probably not needed and shouldn't be used unless properly configured/locked down (which brings up another question...is your system acting like a router for some odd reason? Think router is also known as RIP...i forget offhand)...

Seems he has every service under the sun running on this host. The cause of seeing "router" is that he has the Routing and Remote Access Service turned on. A dead give away is that I saw SNMP running also. So, yes, he has IP forwarding turned on.

Quote:

If you see 0.0.0.0 as the address, that is shorthand for the daemon is listening to every NIC/IP address on your system

Technically, this is incorrect. Yes, I'm nit picky. :) The proper terminology here is "any". Simply put, when you see 0.0.0.0 it means "any" not, "every". It's a matter of sounding like a computer professional or a hobbyist. Use the term any instead. :)

--TH13

Quote:

Chargen and discard are legacy services that have virtually no use anymore. Old skoolers like myself remember them fondly from the "80s". Trace route and ping (via ICMP) have long since replaced Chargen and discard.

This is interesting, I have NEVER seen them on windows machine and I have a large network to monitor. What turns this on typically, IP forwarding, some opern source code ported from Linux? Or more likely a skiddie toolkit. ;)

Quote:

Originally Posted by thehorse13

Most routers/switches do forward this traffic, hence, worm propigation...

Another way to disable CIFS (port 445) is to disable NetBIOS over TCP by simply clicking a checkbox in the advanced properties of TCP/IP.

I have NetBIOS over TCP/IP disabled - I was told by someone previously that I should do this. Do you have any other ideas about disabling port 445?

Quote:

... For a better look at what's happening, download a tool called TCPview (google it) and you can watch your system in (almost) realtime rather than snapshotting it with netstat. Or simply click send/receive in outlook then immediately do a netstat. You'll see port 110 in time wait.

I'm fairly sure that I have Sysinternals TCPview in my "tools library" somewhere but haven't used it. I'll have a look into it.

Quote:

Chargen and discard are legacy services that have virtually no use anymore. Old skoolers like myself remember them fondly from the "80s". Trace route and ping (via ICMP) have long since replaced Chargen and discard. These two protocols were the network testing tools back in the day.

Turn them off. They can only lead to trouble.

How do I turn them off?

I looked into the other "odd" ports (echo, daytime etc.) and it suggested that daytime is part of the NTP. Am I correct in thinking that this relates to the regular clock update that my laptop does to make sure that the time displayed is correct? If so, I'd better leave that one there!

Quote:

... The cause of seeing "router" is that he has the Routing and Remote Access Service turned on. A dead give away is that I saw SNMP running also. So, yes, he has IP forwarding turned on.

I'm lost now so I'd better do some googling! I suspect that I need to go into the Services application and disable the Routing and Remote Access Service?

Many thanks for the detailed response. Who knows, I might just get my head around this!

Quote:

I have NetBIOS over TCP/IP disabled - I was told by someone previously that I should do this. Do you have any other ideas about disabling port 445?

Me personally, I just did the following below on my box xp with sp2 works perfect.

How to disable port 445?
You can easily disable port 445 on your computer. To do so follow these instructions:
Start Registry Editor (Regedit.exe).
Locate the following key in the registry:
HKLM\System\CurrentControlSet\
Services\NetBT\Parameters
In the right-hand side of the window find an option called TransportBindName.
Double click that value, and then delete the default value, thus giving it a blank value.
Close the registry editor.
Reboot your computer.
After rebooting open a command prompt and in it type
netstat -an
See that your computer no longer listens to port 445.

PS full artice can be found here.
http://www.petri.co.il/what's_port_4...2k_xp_2003.htm

@Computernerd22: that's a coincidence! I just did some googling, came across the same article and did just that. I agree that it works like a charm. I came back here to post (for others' benefit) but you beat me to it (Grr!).

One other thing is about port 135. I came across a complicated article which mentioned disabling RPC. Mine is set to start automatically. I don't think that I need it on a single laptop behind an ADSL router. What I could understand mentioned that it would be needed in a large (client/server) network. The article also mentioned disabling things like Windows Time, SSDP Discovery Services, Remote Desktop Help Servives Manager, Com+ Event System, Com+ System Application, System Event Notification (do I really want to do that?) and Task Scheduler (do I really want to do that either?). I've never heard of most of these so I'm relatively happy to disable them but there are some which I think I ought to keep. Any comments?

Quote:

How do I turn them off?

Control panel
Add/remove programs
Add/remove windows components

In this section you will see the services listed under one of the network services categories, though at the moment I can't think of the exact name of the category.

He had to willingly turn them on. They don't come enabled by default nor does a lot of the stuff he is running.

Also, tons of useless services come with Windows server platforms. You don't need 70% of them in typical environments.

Be VERY careful about disabling RPC (port 135). If you do this incorrectly, you'll be dusting off your install CD very quickly.

You don't need daytime running. NTP can stay there if you're syncing to an outside time server at NIST or the US Navy, etc.

Someone gave you a link to Black Viper's windows services list. Use it. It gives you detailed descriptions of what services do and which ones will be impacted should you disable them. Everyone has a different set of requirements so what one person runs another will not. Set up your host per your own needs. No one can answer that except you.

Turning off CIFS (NetBIOS over TCP port 445) can be done with the reg hack as posted by ComputerNerd22. If you don't like mucking in the registry, use the clicky checkbox method I posted in this thread. It does the same exact thing.

In the past I posted a Win32 server hardening guide. Once Negative gets the tutorials links back in order, you can use that guide to harden your Win32 server. I go into great detail about hardening the server services, network stack and so on. To date, *none* of my internet facing windows boxen have been pwned. I used the very same guide I wrote to harden those boxen.

If you can't wait for the links to get fixed, send me a PM and I will forward you the doc.

--TH13

Quote:

He had to willingly turn them on. They don't come enabled by default nor does a lot of the stuff he is running.

Thus my comment "skiddie toolkit" why else would you turn on character generator? ;) I remember some DNS attacks back when on NT 4 Servers.

Quote:

One other thing is about port 135. I came across a complicated article which mentioned disabling RPC. Mine is set to start automatically. I don't think that I need it on a single laptop behind an ADSL router. What I could understand mentioned that it would be needed in a large (client/server) network. The article also mentioned disabling things like Windows Time, SSDP Discovery Services, Remote Desktop Help Servives Manager, Com+ Event System, Com+ System Application, System Event Notification (do I really want to do that?) and Task Scheduler (do I really want to do that either?). I've never heard of most of these so I'm relatively happy to disable them but there are some which I think I ought to keep. Any comments?

Be cautious about disabling port 135 it might be more trouble than it's worth.
Also, I would recommend disabling Windows Time and SSDP Discovery services, and remote desktop, help services manager, System event I have my enabled. Same with task shecdular
COM+ system application 'C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}' part of RPC I wouldnt disable nor would I disable COM+ Event system

Gee - this is complicated!

I checked in Services and there's an entry "Simple TCP Services" which suipports Character Generator, Daytime, Discard, Echo and Quote of the Day. I'll go ahead and disable it, along with Windows Time, SSDP Discovery Services and Remote Desktop Help Services Manager. I'll keep System Event Notification and Task Scheduler, along with the COM+ Event System and COM+ System Application. That seems to have everythig covered, doesn't it?

I'm glad that I didn't disable port 135 if the process might render my system unusable!

Quote:

That seems to have everythig covered, doesn't it?

lol no way. If you havent already disabled the following I would still recommend disabling services/features
example, (ClipBook,remote registry,Indexing Service, etc...) Do you run a wireless network? If not, disable wireless zero configuration.

For 'basic security' for windows xp I do recommend the following
http://labmice.techtarget.com/articl...ychecklist.htm
Cheers, cn22

Quote:

Originally Posted by Ignatius

I'm glad that I didn't disable port 135 if the process might render my system unusable!

This is from GRC.

http://www.grc.com/port_135.htm

Quote:

Port 135 is certainly not a port that needs to be, or should be, exposed to the Internet. Hacker tools such as "epdump" (Endpoint Dump) are able to immediately identify every DCOM-related server/service running on the user's hosting computer and match them up with known exploits against those services.

Quote:

Any machines placed behind a NAT router (any typical residential or small business broadband IP-sharing router) will be inherently safe. And any good personal software firewall should also be able to easily block port 135 from external exposure. That's what you want. In addition, many security conscious ISPs are now blocking port 135 along with the notorious "NetBIOS Trio" of ports (137-139). So even without any of your own proactive security, you may find that port 135 has been blocked and stealthed on your behalf by your ISP.
Going Further: Closing port 135

The widespread exposure and insecurity of this port has generated a great deal of concern among PC gurus. This has resulted in several approaches to shutting down the Windows DCOM server and firmly closing port 135 once and for all. Although applications may be "DCOM enabled" or "DCOM aware", very few, if any, are actually dependent upon the presence of its services. Consequently, it is usually possible (and generally desirable if you're comfortable doing such things) to shut down DCOM and close port 135 without any ill effects. (The fewer things running in a Windows system, the fewer things to suck up RAM and slow everything else down.)
If you are curious about taking control of and terminating another unnecessary Windows "service", the following links will provide you with the information and instructions you'll need:

As it say's your ISP is probably taking care of that one..

Fwiw, another good app for showing real time TCP port connections is Active Ports. Should be able to download it from Snapfiles. It's one up on TCPview in my book because it'll give you the connecting app, for instance your webbrowser connecting on 80.

Try MS's Port Reporter if you're wanting to log all connections. Be aware though you'll be generating large log files, GB's worth of logs. MS also has an app for parsing those logs, too. Both free.

Quote:

Fwiw, another good app for showing real time TCP port connections is Active Ports. Should be able to download it from Snapfiles. It's one up on TCPview in my book because it'll give you the connecting app, for instance your webbrowser connecting on 80.

If you're running Windows XP with SP2 then I would recommend opening command prompt and issuing netstat -nab this will do the samething without downloading 3rd party software or you could go to www.foundstone.com and download fport-2.0 which does basically the same thing.

Quote:

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\cn22>cd c:\fport-2.0
C:\Fport-2.0>fport
FPort v2.0 - TCP/IP Process to Port Mapper
Copyright 2000 by Foundstone, Inc.
http://www.foundstone.com
Pid Process Port Proto Path
1132 -> 135 TCP
1696 LEXPPS -> 1025 TCP C:\WINDOWS\system32\LEXPPS.EXE
2264 -> 1026 TCP
344 LimeWire -> 1812 TCP C:\Program Files\LimeWire\LimeWire.exe
344 LimeWire -> 1813 TCP C:\Program Files\LimeWire\LimeWire.exe
344 LimeWire -> 1822 TCP C:\Program Files\LimeWire\LimeWire.exe
344 LimeWire -> 1824 TCP C:\Program Files\LimeWire\LimeWire.exe
344 LimeWire -> 1827 TCP C:\Program Files\LimeWire\LimeWire.exe
1976 avgemc -> 10110 TCP C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
344 LimeWire -> 19945 TCP C:\Program Files\LimeWire\LimeWire.exe
344 LimeWire -> 45100 TCP C:\Program Files\LimeWire\LimeWire.exe
1132 -> 500 UDP
1696 LEXPPS -> 1028 UDP C:\WINDOWS\system32\LEXPPS.EXE
344 LimeWire -> 1060 UDP C:\Program Files\LimeWire\LimeWire.exe
344 LimeWire -> 1161 UDP C:\Program Files\LimeWire\LimeWire.exe
1976 avgemc -> 1831 UDP C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
2264 -> 4500 UDP
344 LimeWire -> 6347 UDP C:\Program Files\LimeWire\LimeWire.exe
344 LimeWire -> 19945 UDP C:\Program Files\LimeWire\LimeWire.exe

C:\Fport-2.0>

hope this helps, cheers cn22

Thank you for the further information. By "That seems to have everything covered, doesn't it?", I meant the suggestions given thus far. I'll also disable the extras mentioned. I do have wireless at home.

I'll check out the software that various folks have mentioned.

I thought I'd seen that ISPs may also block port 135 on my behalf but I guess that if I hadn't raised the topic here, I wouldn't have received so many tips about monitoring and closing ports and also disabling services.

Quote:

As it say's your ISP is probably taking care of that one..

*Never* rely on an ISP to cover your security stance. Many still run wide open pipes. Block ports 137-139 AND 445 via a firewall of some sort (if required and/or the host is exposed to the internet). I would not attempt to shut off RPC on a win32 host unless utterly necessary. Bad things happen more times than not.

--TH13

He-heh, 3rd-party software is g-o-o-d. :)