what are iss-realsec ,nrpe ,cbt services and are they good?

Question

I am playing with nmap command and for testing using my Lenovo A6000+ phone. When I have scanned its IP with nmap command , its gave me a bit strange result which I am not familiar.

Could somebody help me to understand what are these services and why they are running.

thorin@thorin-BONEFISH:~$ nmap -A -v 192.168.10.18

Starting Nmap 6.40 ( http://nmap.org ) at 2015-05-16 12:05 IST
NSE: Loaded 110 scripts for scanning.
NSE: Script Pre-scanning.
Initiating Ping Scan at 12:05
Scanning 192.168.10.18 [2 ports]
Completed Ping Scan at 12:05, 0.23s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 12:05
Completed Parallel DNS resolution of 1 host. at 12:05, 0.09s elapsed
Initiating Connect Scan at 12:05
Scanning 192.168.10.18 [1000 ports]
Discovered open port 8888/tcp on 192.168.10.18
Completed Connect Scan at 12:05, 5.80s elapsed (1000 total ports)
Initiating Service scan at 12:05
Scanning 1 service on 192.168.10.18
Completed Service scan at 12:05, 6.29s elapsed (1 service on 1 host)
NSE: Script scanning 192.168.10.18.
Initiating NSE at 12:05
Completed NSE at 12:05, 1.76s elapsed
Nmap scan report for 192.168.10.18
Host is up (0.025s latency).
Not shown: 996 closed ports
PORT     STATE    SERVICE     VERSION
2998/tcp filtered iss-realsec
5666/tcp filtered nrpe
7777/tcp filtered cbt
8888/tcp open     http        AirDroid httpd 2.0
|_http-favicon: Unknown favicon MD5: D2A1848B617951B8DA6977F8671BF664
|_http-methods: No Allow or Public header in OPTIONS response (status code 200)
|_http-title: AirDroid
Service Info: OS: Android; Device: phone; CPE: cpe:/o:linux:linux_kernel

NSE: Script Post-scanning.
Read data files from: /usr/bin/../share/nmap
Service detection performed. 

Thank you.

Answer 1

Note: Partial answer to address "what are these services".

---

About ISS-Realsec

PORT     STATE    SERVICE     VERSION
2998/tcp filtered iss-realsec

According to this manual on Nmap:

iss-realsec 2998/tcp    0.000351    # ISS RealSecure IDS Remote Console Admin port

On querying Google for ISS RealSecure IDS Remote Console Admin port, though obvious, various sources points that the port is used by ISS's Realsecure software, a Network based Intrusion Detection System (NIDS). Info from few sources is mentioned below.

• European Union Agency for Network and Information Security mentions it as:

  ISS RealSecure is a commercial firewall/IDS package, designed to provide security protection for large, complex networks. Sensors can take input from hosts or networks and report anonmalies back to a central management station.

  Source: http://www.iss.net/ Platform:

  • Windows
  • Unix

• Network Security Resource and SANS also has the similar info here and here, respectively.

Note that ISS stands for Internet Security Systems which is now, IBM Internet Security Systems.

About NRPE

 PORT     STATE    SERVICE     VERSION
 5666/tcp filtered nrpe

According to this manual on Nmap:

nrpe  5666/tcp    0.006614    # Nagios NRPE

Querying Google for Nagios NRPE gives result, more or less similar, and is mentioned below.

• Nagios on its exchange website states that:

  NRPE [addon] allows you to remotely execute Nagios plugins on other Linux/Unix machines. This allows you to monitor remote machine metrics (disk usage, CPU load, etc.). NRPE can also communicate with some of the Windows agent addons, so you can execute scripts and check metrics on remote Windows machines as well.

  _{(See similar info on Wikipedia.)}

• What is Nagios? What does it do?

  Nagios is a powerful monitoring system that enables organizations to identify and resolve IT infrastructure problems before they affect critical business processes.

  By using Nagios, you can:

  • Plan for infrastructure upgrades before outdated systems cause failures
  • Respond to issues at the first sign of a problem
  • Automatically fix problems when they are detected
  • Coordinate technical team responses
  • Ensure your organization's SLAs are being met
  • Ensure IT infrastructure outages have a minimal effect on your organization's bottom line
  • Monitor your entire infrastructure and business processes

About CBT

 7777/tcp filtered cbt

The aforementioned guide for Nmap doesn't have any information to lead.

• Querying Google for such results this page et al. which states:

   Service                                                                    [Default TCP]     Notes
   Oracle HTTP Server non-SSL or Oracle9iAS Web Cache HTTP Listen non-SSL     7777              This port is IANA-registered for "cbt" by cs.ucl.ac.uk
  

  _{(IANA here doesn't have useful info other than the name of the Assignee. )}

• Wikipedia has the following info :

   Port     TCP     UDP     Description                                             Status
   7777     TCP             iChat server file transfer proxy                        Unofficial
   7777     TCP             Oracle Cluster File System 2                            Unofficial
   7777     TCP             Windows backdoor program tini.exe default               Unofficial
   7777     TCP             Just Cause 2: Multiplayer Mod Server                    Unofficial
   7777     TCP             Xivio default Chat Server                               Unofficial
   7777     TCP             Terraria default server                                 Unofficial
   7777             UDP     San Andreas Multiplayer (SA-MP) default port server     Unofficial
  

  _{(There can be a malware running on this port as noted here. Also, Oracle has a link here using Netcat (nc) to connect to a machine using 7777 port.)}

About Airdroid

PORT     STATE    SERVICE     VERSION
8888/tcp open     http        AirDroid httpd 2.0

Based on the info in the question and my own experience, Airdroid uses this port to host a server on your phone so that a user can access it through a browser.

What is Airdroid?

AirDroid is a free and fast Android device manager app that allows you to access Android phone/tablet from computer remotely and securely. Manage SMS, files, photos and videos, WhatsApp, Line, WeChat and more on computer.

_{(Click here to see Airdroid's usage guide which uses port 8888.)}

---

_{Other than port 8888, I can't comment possibly why your android device has these open ports which reflects services that are not known for Android at least, which makes this answer not very useful to resolve the question but enough to lead you further :-)}