Port scan on a VIP shows UDP port 123 and 161 open

[kaivanov]

I have a loadbalancer with one virtual server for doing HTTP balancing to two back-end nodes in a pool. When I run:

nmap -sV -sU VIP -p 123,161 I get both ports as being open. The only ports that I have opened on the backend nodes are 80 and 22. My question is why when I scan the VIP I get these ports being open. I thought Zeus starts it's services only on one interface, and not on all VIP's?

[owen · Accepted solution]

Hi Konstantin,

On the virtual appliance, we ship with an NTP server and an SNMP server - these explain the two UDP ports you've detected.

You can disable the SNMP server using the settings in the 'System' pane in the user interface.

The NTP server runs permanently (unless you edit the startup-scripts in the virtual appliance).  It should not present a security risk, but you should firewall it off if you are concerned.

regards

Owen