1

TG1672G cable modem in bridge mode, the modem's built in router still gets a IPv4/IPv6 public address (and devices connected to the modem can get public IPv4/IPv6 addresses too). This modem is Intel PUMA6+RT3593.

nmap shows 9081/tcp open unknown.

Trying 1.2.3.4...
Connected to 1.2.3.4.
Escape character is '^]'.

How can I find out what this port is used for? The modem in bridge mode shouldn't get a public IP address to begin with, not to mention an opened port.

TCP/IP fingerprint:
OS:SCAN(V=6.40%E=4%D=11/18%OT=9081%CT=1%CU=33663%PV=N%DS=3%DC=I%G=Y%TM=564C
OS:6CB8%P=x86_64-pc-linux-gnu)SEQ(SP=C4%GCD=1%ISR=CC%TI=Z%CI=Z%TS=7)SEQ(SP=
OS:C4%GCD=1%ISR=CC%TI=Z%CI=Z%II=I%TS=7)OPS(O1=M5B4ST11NW0%O2=M5B4ST11NW0%O3
OS:=M5B4NNT11NW0%O4=M5B4ST11NW0%O5=M5B4ST11NW0%O6=M5B4ST11)WIN(W1=2D40%W2=2
OS:D40%W3=2D40%W4=2D40%W5=2D40%W6=2D40)ECN(R=Y%DF=Y%T=40%W=2DA0%O=M5B4NNSNW
OS:0%CC=N%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF
OS:=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=
OS:%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%
OS:T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD
OS:=S)


1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
SF-Port9081-TCP:V=6.40%I=9%D=11/18%Time=564D259B%P=x86_64-pc-linux-gnu%r(G
SF:etRequest,5,"0\n0\n\n")%r(FourOhFourRequest,5,"0\n0\n\n")%r(OfficeScan,
SF:5,"0\n0\n\n")%r(apple-iphoto,6,"9003\n\n")%r(metasploit-msgrpc,5,"0\n0\
SF:n\n")%r(hazelcast-http,5,"0\n0\n\n");
  • Have you checked the documentation? Can you put a packet sniffer in front of it? – schroeder Nov 18 '15 at 15:42
  • The device in question is a DOCSIS modem. Do you have recommendations for tapping a cable modem's outside interface? – sdaffa23fdsf Nov 18 '15 at 17:35
  • Wait - where are you running the nmap scan from? Inside your network or outside? – schroeder Nov 18 '15 at 17:37
  • I got the same result from both inside and outside (Internet). That's what raised my security concern. I don't have the equipment to capture traffic between modem and CMTS. – sdaffa23fdsf Nov 18 '15 at 17:40
  • you need to include that detail in your question – schroeder Nov 18 '15 at 18:12
2

Use Nmap's service version detection. Using a recent version of Nmap (so that you have the most complete database of probes and response matches), run:

nmap -sV -p 9081 1.2.3.4

And the result should be shown. If the port responds to any of Nmap's probes, you will either get a positive match or the response will be shown in a blob at the end of the scan with a request for you to submit it to Nmap for further identification. You can often get some idea by looking at the blob what kind of service is running, even if Nmap doesn't really know.

  • If service is unknown, I doubt version detection is going to do much. "PORT STATE SERVICE VERSION 9081/tcp open unknown 1 service unrecognized despite returning data" – sdaffa23fdsf Nov 18 '15 at 17:35
  • 1
    @sdaffa23fdsf That "despite returning data" part means you should have been given a service fingerprint (block of lines all starting with "SF"). That contains the data the probes returned, and is critical for knowing what the service is. Also, what version of Nmap do you have? New service matches are added all the time. – bonsaiviking Nov 18 '15 at 19:24
  • Could also try nmap -sV --version-all -p 9081 1.2.3.4. Might have better luck there. – Iszi Nov 18 '15 at 20:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.