Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm running Zenmap on my Windows 7 laptop. I ran an intense scan with UDP targeting my router 192.168.1.1.
I realize that I'm probing into the back end of the router from the inside and that any open ports are nothing to be concerned about.
At the time, my iPod (on standby/not turned on) and my laptop were the only connected devices.

In the left-hand window under HOSTS (OS / Host) I have two entries:

  1. host 2-96--.as13285.net(2.96.*.""") - (I've hidden some numbers as *)
  2. 192.168.0.1

With host 2-96.... highlighted, and the Ports/Hosts tab in the right window selected, I see 21,22,23,443 all filtered and 80, 631 (IPP) open.

However, if instead I now highlight 192.168.1.1, I see two more services listed, both UDP, and both open: 53 and 1900 (UPnP)

My questions are:

  1. Given that my external IP address (2-96-*-*) and 192.168.1.1 are exactly the same device (the router), why do I see 2 extra services (granted they are UDP) if I look at the 192.168.1.1 scan?

  2. I envisage the NAT and firewall systems as sitting in the middle of the router, between the front end and the back end.
    And thinking that the back end of my router is waiting to receive any traffic from any possible port inside my network, I would not have been surprised if the scan had said all 65000 ports are open or at least listening/filtered (I know that "listening" is not a state NMAP recognises).
    So what's so special about the 6/8 ports/services that are detected and why aren't all 65000 found in one way or another?

share|improve this question
2  
Can you copy and paste the nmap command that was used? It should appear at the top of the zenmap window. –  scuzzy-delta Oct 19 '13 at 21:52

1 Answer 1

This is all to be expected.

A router with multiple interfaces can have services listen on just some interfaces.

You're right conceptually that NAT sits between the two interfaces, but normal outbound NAT does not create open ports.

Sit back and chill out :-)

share|improve this answer
    
short answer: router offers different services to internal interfaces than external. –  schroeder Oct 23 '13 at 1:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.