Nmap seeing open ports in IOS

John Biederstedt · ‎09-21-2015

I see these ports open when running nmap against IOS switches: 22, 902, 903, 3389, 5900, 5906. These were just form 3750's running 12.2(35)SE2 and 6900's running 12.2(33)SXH2a. I would have expected ports other than 22 to respond, and some boilerplate security scans flag them for explanation. What are these ports for? I don't think there are services running on these switches, but mybe there are.

Any info is appreciated,

John

Seb Rupik · ‎09-30-2015

Hi John,

You'd expect most switches to have port 22 open. Maybe 23, and possibly 80 or 443 .

The ports you have listed are all well known (https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers), so most likely part of static NAT configuration on the switches. I guess you are running nmap against the 'outside' interfaces to get these results?

cheers,

Seb.