列出的几个端口是使用nmap打开的，但是只有几个端口在服务器中监听。

Question

I tried to scan ports with nmap to one of my servers in the same LAN and I got many ports opened:

Host is up (0.058s latency).
Not shown: 993 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
110/tcp open pop3
143/tcp open imap
993/tcp open imaps
995/tcp open pop3s
3306/tcp open mysql

so, I logged into the server to see what services are listening and there are only few of them:

netstat -plnt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN      1205/mysqld
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      32225/sshd
tcp6       0      0 :::22                   :::*                    LISTEN      32225/sshd
tcp6       0      0 :::4118                 :::*                    LISTEN      1264/ds_agent

Why then, those ports are listed in the nmap and how I can close them?

Answer 1

Add the --reason option to your Nmap scan to see information about each port. This may help reveal when responses are coming from a different source than the target. For instance, if you see 22/tcp open ssh syn-ack ttl 60 but 110/tcp open pop3 syn-ack ttl 63 then based on the ttl difference, the responses were likely coming from different targets. You say you are on a LAN, so this is less likely.

It's also possible that the ports were open when you scanned, but the process that was listening was turned off by the time you logged in to check. Can you confirm the same ports are still open? Can you check logs for a mail server service starting and stopping?

One more possibility would be a rootkit. This is malware that carefully hides its behavior from on-host diagnostic tools like netstat . This possibility is unlikely based on the ports you listed, which are consistent with a mail server instead. Malware would be unlikely to listen on so many commonly-used ports, but it is worth mentioning as a general case.