Port 5000 question

I just did a port scan on my iBook just for fun, and I found port 5000 to be open. Is this normal for mac?

Yes and No,

If you have no firewall enabled then all your ports are open. Whether you have services running on those ports is a different matter.

On the hand if you have a firewall inplace and a port scan detects a port open then this is not normal.

Was it a TCP port or UDP port that was open?

Do you have the built in firewall enabled on your Mac?

What kind of internet connection do you have? are you behind a router?

You never said if you were behind a router or not? if your router supports UPnP and it is enabled then this may explain why the port may be open.

If you have no firewall enabled then all your ports are open. Whether you have services running on those ports is a different matter.

Tim, I don't believe that is correct. I believe that in Mac OS X, all ports (or almost all ports) are closed by default. You only open a port when you run a service. Maybe we are saying the same thing and only have a semantic distinction.

For a test, I just hooked my computer directly to my cable modem and ran the port test at Shields UP!. A scan of the common ports showed they were either closed or in stealth mode. In particular, port 5000 was listed as closed. The OP showing that theirs was open is indeed a function of the router. The router should be able to be configured to disable this.

A more detailed scan did show that port 427 -- SLP (service location) was open.

EDIT: I found the reason port 427 was listed as open. I had file sharing turned on when I first ran the port scan as I had been behind NAT protection. It looks like turning off file sharing leaves port 427 open even though it does close port 548 (AFP). My guess is that port 427 is staying open until the next boot. Hmmm... time to do a little more digging. I'm not sure this seems right.

Matt

Tim, I don't believe that is correct. I believe that in Mac OS X, all ports (or almost all ports) are closed by default. You only open a port when you run a service. Maybe we are saying the same thing and only have a semantic distinction.

You are correct although I did mean the same thing. But I should be more specific with my words. There are 3 states open, closed or blocked.

I use Sygate to scan my firewall, they described what is meant by open, closed or blocked in their faq.