I am playing with nmap command and for testing using my Lenovo A6000+ phone. When I have scanned its IP with nmap command , its gave me a bit strange result which I am not familiar.

Could somebody help me to understand what are these services and why they are running.

thorin@thorin-BONEFISH:~$ nmap -A -v

Starting Nmap 6.40 ( http://nmap.org ) at 2015-05-16 12:05 IST
NSE: Loaded 110 scripts for scanning.
NSE: Script Pre-scanning.
Initiating Ping Scan at 12:05
Scanning [2 ports]
Completed Ping Scan at 12:05, 0.23s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 12:05
Completed Parallel DNS resolution of 1 host. at 12:05, 0.09s elapsed
Initiating Connect Scan at 12:05
Scanning [1000 ports]
Discovered open port 8888/tcp on
Completed Connect Scan at 12:05, 5.80s elapsed (1000 total ports)
Initiating Service scan at 12:05
Scanning 1 service on
Completed Service scan at 12:05, 6.29s elapsed (1 service on 1 host)
NSE: Script scanning
Initiating NSE at 12:05
Completed NSE at 12:05, 1.76s elapsed
Nmap scan report for
Host is up (0.025s latency).
Not shown: 996 closed ports
2998/tcp filtered iss-realsec
5666/tcp filtered nrpe
7777/tcp filtered cbt
8888/tcp open     http        AirDroid httpd 2.0
|_http-favicon: Unknown favicon MD5: D2A1848B617951B8DA6977F8671BF664
|_http-methods: No Allow or Public header in OPTIONS response (status code 200)
|_http-title: AirDroid
Service Info: OS: Android; Device: phone; CPE: cpe:/o:linux:linux_kernel

NSE: Script Post-scanning.
Read data files from: /usr/bin/../share/nmap
Service detection performed. 

Thank you.


1 Answer 1


Note: Partial answer to address "what are these services".

About ISS-Realsec

2998/tcp filtered iss-realsec

According to this manual on Nmap:

iss-realsec 2998/tcp    0.000351    # ISS RealSecure IDS Remote Console Admin port

On querying Google for ISS RealSecure IDS Remote Console Admin port, though obvious, various sources points that the port is used by ISS's Realsecure software, a Network based Intrusion Detection System (NIDS). Info from few sources is mentioned below.

Note that ISS stands for Internet Security Systems which is now, IBM Internet Security Systems.

About NRPE

 5666/tcp filtered nrpe

According to this manual on Nmap:

nrpe  5666/tcp    0.006614    # Nagios NRPE

Querying Google for Nagios NRPE gives result, more or less similar, and is mentioned below.

  • Nagios on its exchange website states that:

    NRPE [addon] allows you to remotely execute Nagios plugins on other Linux/Unix machines. This allows you to monitor remote machine metrics (disk usage, CPU load, etc.). NRPE can also communicate with some of the Windows agent addons, so you can execute scripts and check metrics on remote Windows machines as well.

    (See similar info on Wikipedia.)

  • What is Nagios? What does it do?

    Nagios is a powerful monitoring system that enables organizations to identify and resolve IT infrastructure problems before they affect critical business processes.

    By using Nagios, you can:

    • Plan for infrastructure upgrades before outdated systems cause failures
    • Respond to issues at the first sign of a problem
    • Automatically fix problems when they are detected
    • Coordinate technical team responses
    • Ensure your organization's SLAs are being met
    • Ensure IT infrastructure outages have a minimal effect on your organization's bottom line
    • Monitor your entire infrastructure and business processes

About CBT

 7777/tcp filtered cbt

The aforementioned guide for Nmap doesn't have any information to lead.

  • Querying Google for such results this page et al. which states:

     Service                                                                    [Default TCP]     Notes
     Oracle HTTP Server non-SSL or Oracle9iAS Web Cache HTTP Listen non-SSL     7777              This port is IANA-registered for "cbt" by cs.ucl.ac.uk

    (IANA here doesn't have useful info other than the name of the Assignee. )

  • Wikipedia has the following info :

     Port     TCP     UDP     Description                                             Status
     7777     TCP             iChat server file transfer proxy                        Unofficial
     7777     TCP             Oracle Cluster File System 2                            Unofficial
     7777     TCP             Windows backdoor program tini.exe default               Unofficial
     7777     TCP             Just Cause 2: Multiplayer Mod Server                    Unofficial
     7777     TCP             Xivio default Chat Server                               Unofficial
     7777     TCP             Terraria default server                                 Unofficial
     7777             UDP     San Andreas Multiplayer (SA-MP) default port server     Unofficial

    (There can be a malware running on this port as noted here. Also, Oracle has a link here using Netcat (nc) to connect to a machine using 7777 port.)

About Airdroid

8888/tcp open     http        AirDroid httpd 2.0

Based on the info in the question and my own experience, Airdroid uses this port to host a server on your phone so that a user can access it through a browser.

What is Airdroid?

AirDroid is a free and fast Android device manager app that allows you to access Android phone/tablet from computer remotely and securely. Manage SMS, files, photos and videos, WhatsApp, Line, WeChat and more on computer.

(Click here to see Airdroid's usage guide which uses port 8888.)

Other than port 8888, I can't comment possibly why your android device has these open ports which reflects services that are not known for Android at least, which makes this answer not very useful to resolve the question but enough to lead you further :-)

  • 1
    Man , you are just AWESOME. Thank you. I will forward to see some more reliable answers on these three services and I will try to add to your answer.
    – Raja G
    May 16, 2015 at 9:36
  • Sure; looking forwards for it, since I'm interested to know why these desktop services are found running in your Android.
    – Firelord
    May 16, 2015 at 9:40
  • May be lenovo want their users to be more secure.
    – Raja G
    May 16, 2015 at 10:09
  • IDK about phone but you may take a note on Superfish on Laptops.
    – Firelord
    May 16, 2015 at 10:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .