I have been trying to lessen which ports my Debian 9 has open at given times. Been trimming down with a static IP, disabling services from systemctl, and I got my UDP and TCP ports narrowed down; but for some reason, my NetworkManager has a RAW socket with an UNCONN state just sitting around waiting for something. My question is, why is this needed? Also, is there a way to check for this with Zenmap / nmap?
root_user@box# ss -64tuldpw Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port raw UNCONN 0 0 :::ipv6-icmp :::* users:(("NetworkManager",pid=584,fd=18))
I noticed within the NetworkManager repository
I found a function called:
int lldp_network_bind_raw_socket(int ifindex) in
So I guess the raw socket is part of the local link layer advertisement portion of NetworkManager?