[ALUG] Why are some of my ports appearing in a port scan?

Hi folks.

I'm confused.

Every now and again, I use Shields UP! at grc.com to check that there's unexpectedly open ports on my system. I checked last night and I found 2 open ports, 5 closed ports and all the rest were "stealth" ports. The 2 open ports I was expecting. Stealth ports mean simply that they don't reply in any shape or form to the outside world. I expect, and usually get, all my ports except for the two open ones to appear as "stealthy".

I don't understand why I'm now getting 5 closed ports showing up.

I have a cable modem that's configured to do NAT for me. It has 3 port forwarding rules, each for single tcp ports. (One of these rules is outside the range usually scanned for by SheildsUp, that's why it's not included in the count of open ports)

I don't forward any port ranges. I don't have a DMZ. UPnP is disabled.

The ports that are appearing as closed are: 135, 137, 138, 139, 445

I turned off my server's smbd service and rescanned, and I got 135, 137, 138, 445 i.e. port 139 disappeared. So it does seem that services running on the server directly affect ports that are being shown as closed on the router, despite there being no port forwarding rule for them to get past the router onto the server.

135 DCOM Service Control Manager 137 NetBIOS Name Service 138 NETBIOS Datagram Service 139 NETBIOS Session Service 445 Microsoft Directory Services

I've just used NetScan on my mobile, (whilst not connected to wifi), and scanning my public IP address I got two expected ports open, and also 80 HTTP 110 POP 143 Internet Message Access

I tried with a different mobile app (Port Scan) and I got 1 of the expected ports listed as open, and 80 HTTP 110 POP 143 Internet Message Access 8080 Alternate HTTP

I tried with an on-line port scanner, http://nmap.online-domain-tools.com/, and I got only the two expected ports open.

I've just tried rerunning GRC's Shields up and now it reports the two expected open ports and also just 137 and 138 as closed.

I'm rather confused as to what's going on. Anyone got any ideas?

Regards Steve