I have been trying to lessen which ports my Debian 9 has open at given times. Been trimming down with a static IP, disabling services from systemctl, and I got my UDP and TCP ports narrowed down; but for some reason, my NetworkManager has a RAW socket with an UNCONN state just sitting around waiting for something. My question is, why is this needed? Also, is there a way to check for this with Zenmap / nmap?

root_user@box# ss -64tuldpw 
Netid  State      Recv-Q Send-Q    Local Address:Port   Peer Address:Port                
raw    UNCONN     0      0         :::ipv6-icmp         :::*            

I noticed within the NetworkManager repository


I found a function called: int lldp_network_bind_raw_socket(int ifindex) in NetworkManager/src/systemd/src/libsystemd-network/lldp-network.c

So I guess the raw socket is part of the local link layer advertisement portion of NetworkManager?


  • 1
    NetworkManager does terrible things, I always mask the service in my production servers because it tends to add bad entries to /etc/hosts. Disabling network manager just makes things easier and cleaner. – Hunter.S.Thompson Oct 1 '17 at 17:30

Lldp is a protocol at layer 2, not like ipv6. Certainly, the raw socket for lldp isn't ipv6-icmp type but ethernet. Also, lldp listening is not done unless you enable it.

NM uses libndp for RA handling, which opens a raw socket and which I suspect is the socket you are seeing. If you configure ipv6.method=ignore, the socket is probably no longer be opened.

| improve this answer | |
  • 1
    It looks like using the option "Automatic, DHCP only" under IPv6 settings for the network under the NetworkManager GUI for my network settings. After making that change, the listing for the ipv6-icmp port went away. Thank you, thaller – seanlum Oct 1 '17 at 20:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.