Ask Your Question
0

Is it possible to detect what is blocking port 80

asked 2020-07-17 13:13:27 +0000

RobertChalmers gravatar image

updated 2020-07-17 14:11:28 +0000

grahamb gravatar image

Ok, curl returns this on my local machine...

"connect to 94.15.100.134 port 80 failed: Connection refused"

even

telnet localhost 80 returns
connect to address 127.0.0.1: Connection refused

and to the server with the http running on it directly

robert$ telnet 192.168.0.15 80
Trying 192.168.0.15...
telnet: connect to address 192.168.0.15: Connection refused
telnet: Unable to connect to remote host

I've tried everything. I mean everything. at least tht I can think of. Port forwarding is on. and correct. However, even a check open port from outside returns Port Closed. The ISP swears black and blue that they aren't blocking the port...

is there any way of finding out what and where it's being blocked by through Wireshark?

I have it running of course and can see the no-ip service trying to do its thing - but to no avail, it seems.

40003   7509.869012 ec2-52-9-108-157.us-west-1.compute.amazonaws.com    192.168.0.15    HTTP/XML    557 HTTP/1.1 200 OK 

40005   7509.870275 192.168.0.15    ec2-52-9-108-157.us-west-1.compute.amazonaws.com    TCP 66  60220 → http(80) [FIN, ACK] Seq=249 Ack=656 Win=131072 Len=0 TSval=208303976 TSecr=1225515866

by the way. Complete newbie to Wireshark Robert

edit retag flag offensive close merge delete

2 Answers

Sort by » oldest newest most voted
0

answered 2020-07-18 03:02:58 +0000

Guy Harris gravatar image

updated 2020-07-18 03:03:21 +0000

I get the same result on my machine:

$ curl http://94.15.100.134/
curl: (7) Failed to connect to 94.15.100.134 port 80: Connection refused
$ curl http://127.0.0.1
curl: (7) Failed to connect to 127.0.0.1 port 80: Connection refused

The latter is because I don't have an HTTP server running on my machine; unless you have an HTTP server running on your machine, you should expect that telnet localhost 80 will return "Connection refused".

Are you certain that 94.15.100.134 has an HTTP server listening on port 80? If I run Wireshark while running curl http://94.15.100.134, it shows the initial SYN trying to connect to 94.15.100.134, followed by a RST coming back from 94.15.100.134, which is not a sign that 94.15.100.134 has an HTTP server. The same thing happens if I capture on lo0 and try to fetch from 127.0.0.1, so the RST might be a sign that nobody's listening on that port.

edit flag offensive delete link more
0

answered 2020-07-17 13:38:03 +0000

grahamb gravatar image

Wireshark will not help here, as a gentle reminder Wireshark is a packet analyser, e.g. a microscope and not a network swiss army knife.

More appropriate tools for the task would be netstat or lsof on the server host to determine if the ports are open, and if so, by which process.

Your use of a private local IP address (192.168.0.15) is confusing me. This address is not routable over the internet and cannot be connected to from a host outside of your local LAN. You can use port forwarding on your firewall so that external connections to the external internet IP of the firewall are forwarded on to the local IP.

You could help by adding some basic info to your question such as where and what the server is and where and what the client is and any known intervening devices such as firewalls.

edit flag offensive delete link more

Comments

I showed the external address at the start. I showed the private internal address to show that it's not accessible internally either. So basically I was just hoping that there might be a clue here but I guess not. Thanks anyway Robert

RobertChalmers gravatar imageRobertChalmers ( 2020-07-17 14:44:46 +0000 )edit

So something like:

internet --- 94.15.100.134 firewall ???? ---- 192.168.0.15 server

If so, then use netstat or lsof on the server to ensure that a process is listening on port 80, then Wireshark or tcpdump on the server to see if the connection attempt is being passed from the firewall.

grahamb gravatar imagegrahamb ( 2020-07-17 14:56:15 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2020-07-17 13:13:27 +0000

Seen: 2,358 times

Last updated: Jul 18 '20