I have some question in closing port, I think I got some strange things.

When I use execute

nmap --top-ports 10

it shows that 23/TCP port is open.

But when I execute

nmap --top-ports 10 localhost

it show that 23/tcp port is closed.

Which of them is true? I want to close this port on my whole system, how can I do it?

  • 10
    they are both true. TCP ports aren't associated with hosts. they are associated with network interfaces. the difference is subtle but important. interfaces are often the same as hosts, but not always. in this case (as stated in answers) localhost is accessing the lo (loopback) interface. the IP Address is accesing your real interface, probably eth0 or wlan0 or somesuch.
    – strugee
    Jun 30, 2014 at 20:41
  • 3
    The apparent naivety of this question led to some terrific answers. Thank you for the question!
    – dotancohen
    Jul 2, 2014 at 6:35

5 Answers 5


Nmap is a great port scanner, but sometimes you want something more authoritative. You can ask the kernel what processes have which ports open by using the netstat utility:

me@myhost:~$ sudo netstat -tlnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address   Foreign Address   State    PID/Program name
tcp        0      0*         LISTEN   1004/dnsmasq    
tcp        0      0*         LISTEN   380/sshd        
tcp        0      0*         LISTEN   822/cupsd       
tcp6       0      0 :::22           :::*              LISTEN   380/sshd        
tcp6       0      0 ::1:631         :::*              LISTEN   822/cupsd       

The options I have given are:

  • -t TCP only
  • -l Listening ports only
  • -n Don't look up service and host names, just display numbers
  • -p Show process information (requires root privilege)

In this case, we can see that sshd is listening on any interface ( port 22, and cupsd is listening on loopback ( port 631. Your output may show that telnetd has a local address of, meaning it will not answer to connections on the loopback adapter (e.g. you can't telnet

There are other tools that will show similar information (e.g. lsof or /proc), but netstat is the most widely available. It even works on Windows (netstat -anb). BSD netstat is a little different: you'll have to use sockstat(1) to get the process information instead.

Once you have the process ID and program name, you can go about finding the process and killing it if you wish to close the port. For finer-grained control, you can use a firewall (iptables on Linux) to limit access to only certain addresses. You may need to disable a service startup. If the PID is "-" on Linux, it's probably a kernel process (this is common with NFS for instance), so good luck finding out what it is.

Note: I said "authoritative" because you're not being hindered by network conditions and firewalls. If you trust your computer, that's great. However, if you suspect that you've been hacked, you may not be able to trust the tools on your computer. Replacing standard utilities (and sometimes even system calls) with ones that hide certain processes or ports (a.k.a. rootkits) is a standard practice among attackers. Your best bet at this point is to make a forensic copy of your disk and restore from backup; then use the copy to determine the way they got in and close it off.


To "close" the port you can use iptables

sudo iptables -A INPUT -p tcp --dport 23 -m state --state NEW,ESTABLISHED -j DROP
  • 2
    In this answer, "closing the port" means "ignoring any traffic to it". The port is still open, but it cannot be reached anymore. Also note that DROP does as it says, it sees the packet and then ignores it. Normally (without iptables enabled), the kernel would send an ICMP port unreachable packet back (which can be simulated with the REJECT target instead of DROP).
    – Lekensteyn
    Jul 1, 2014 at 15:36
  • 4
    @Lekensteyn ICMP port unreachable is for UDP. The proper packet to reply with is a TCP RST packet, which can also be generated using the REJECT target by writing -j REJECT --reject-with tcp-reset.
    – kasperd
    Jul 1, 2014 at 16:28
  • Despite its lower score, this is the very first answer to actually answer the question. Whoever can add more scores here, please do so.
    – EnzoR
    Apr 18, 2018 at 9:08

A Linux system has a so called loopback interface, which is for internal communication. Its hostname is localhost and its IP address is

When you run nmap on localhost, you actually run the portscan on the virtual loopback interface. is the IP address of your physical (most likely eth0) interface.

So you've run nmap on two different network interfaces, this is why there's a difference in the open ports. They are both true.

If you have TCP port 23 open, it is likely that you have a telnet server running (which is not a good thing due to its lack of encryption) or you have some kind of trojan horse on your machine.

  • 1
    so how can i close it?
    – user74080
    Jun 30, 2014 at 20:18
  • 4
    @user74080 You can add an iptables rule as a nearby answer suggests, but it will keep the service going unused, which consumes resources. So if you have telnetd running, just shut it down.
    – psimon
    Jul 1, 2014 at 6:23

If you do nmap localhost, it tells you about a different situation: some programs on linux work as server although they are used only locally. This is because other programs use them like a server they connect to. So both answers are true, since you ask something different.

Port 23 is used for telnet. Normally not used anymore. Try to do nmap -sV to find out which program opens the port.

(192... is a local network IP, so the result of nmap <your outside world IP> will also give a different result, because of possible firewall settings etc)


If you have a service running and listening on port 23, it is arguably cleaner to stop the process that listens to port 23 (probably telnet) than to keep it running and close or block port 23 using iptables.

When there's no process listening on a port, even in the absence of a firewall block, any attempt to connect to it should result in an immediate "connection refused" (ECONNREFUSED to connect(2))

One way to find the process (and its pid) that listens on port 23, if there's such process, is:

sudo lsof -i -P | grep ':23 '

In the above -i lists open internet ports (both UDP and TCP), and -P inhibits translation of ports to service names (via /etc/services)

After you found the running process listening on port 23, you can figure out how it got started by looking at the process tree (with say, pstree). If its parent is init (very likely), you may recursively search for the name of the process under /etc. e.g.:

sudo grep -r telnet /etc

This should lead you to the best way to disable it from running in the 1st place.

  • There's no need to use grep (and if there were, no need for quotes). You can use sudo lsof -Pi :23.
    – Théophile
    Sep 16, 2019 at 16:11
  • The quotes are there for a good reason. To make sure only the telnet port (23) is matched. If you don't include a space after the :23 it will match :234, :2345 etc.
    – arielf
    Sep 17, 2019 at 17:14
  • Ah, I see. That makes sense for grep. Incidentally, it seems that the command without grep (lsof -Pi :23) looks for an exact match.
    – Théophile
    Sep 17, 2019 at 21:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .