What is the IP Service List, why do the entries change and should I disable everything for security purposes?

RouterOS Beginner Basics
1

I have a couple of question about the IP → IP Service List.

The documentation states

IP/Services lists the protocols and ports used by various MikroTik RouterOS services and containers

however this is slightly unclear since the entries listed changes with time and also there is a “disable”/”enable” button in this dialog box.

I’m not sure how to interpret the entries. Is this a list of running processes with their associated port numbers? Or is it more like a list of actively listening sockets?

The enable/disable buttons suggest this is a list of processes which can be enabled and disabled. However, the entries change with time. I can see that dhcpclientwith associated port 68appears and disappears every few seconds. This suggests this is more like a “task manager” “list of what is actually running right now” rather than a list of what processes/service should be enabled.

Is the distinction between the two cases obvious, or is this description to opaque?

So, I’m interested to know what specifically is it, and why does the list change with time?

Then, in addition to this, should I go ahead and disable all of these things, with the exception of winboxwhich runs with associated port 8291? I don’t think I need any of these services running, except for the listening socket for Winbox to connect to, so that I can configure the device.

The full list of entries are:

  • api
  • api-ssl
  • btest
  • dhcp
  • dhcp-client (which appears and disappears)
  • discover
  • ftp
  • ssh
  • telnet
  • winbox
  • www
  • www-ssl
2

It lists every listening socket from what I could gather.

Some (WWW, Winbox, Telnet, SSH, etc) can be disabled. Some (like dhcp_client) can’t.

In the case of DHCP Client for example, it sends a DHCP message out on the wire, and then listens for a response from the DHCP server. During the time that it waits for a response, the dhcp_client will have a listening socket open. Hence, why it comes and goes.

I don’t personally like the way that this has been done either - but it is what it is.