0

I noticed my internet connection was acting a little strange (stuttering up abruptly seemingly randomly), so I thought I'd see what's using it using Zenmap.

I ran "Intense scan" using the latest version of Zenmap and set the target to my modem's default gateway ip.

5 ports open 2 filtered. Most of the service names check out (netbios-ssn, microsoft-ds, icslap, http (Router name as Version)...), but there's this one I find really suspicious:

23 tcp open telnet Openwall GNU/*/Linux telnetd

When I search for windows 10 and telnet nothing noteworthy pops up. If I search Windows 10 Openwall... I get nothing with both those keywords in it. Checking out Openwall, I'm greeted with this Jack the Ripper bit about fast password cracking.

I've never installed any such software directly, and checking out the running services in task manager there's nothing by the name of "telnet" or "Openwall".

Any kind soul willing to tell me if I should freak out or not?

Improve this question
6
  • 1
    Please clarify what exactly the target of your scan was? It is very confused. Why is Win10 a factor? Why are you checking your local running services?
    – schroeder ♦
    Mar 29, 2016 at 15:29
  • Are you using a router which might have an open telnetd? Have you tried connecting to the host using telnet yourip? What does it say? Is your "modem's default gateway IP" even your machine?
    – Tobi Nary
    Mar 29, 2016 at 15:30
  • If you look on Openwall's site, you will see that they have their own version of Linux: openwall.com/Owl THAT'S what you scanned, and it's that machine's telnet you scanned.
    – schroeder ♦
    Mar 29, 2016 at 15:31
  • smokedispenser: "Are you using a router which might have an open telnetd?" This is definitely possible. I'm living in an apartment in Japan and contracted an ISP independently. They provided me with the router and had someone set it up on some hub in the apartment (a thing for ISP's to track internet usage in specific rooms). In short, I don't know, but the ISP is one of the few major carriers. "Have you tried connecting to the host using telnet yourip? What does it say?" Sorry, I don't know how. "Is your "modem's default gateway IP" even your machine?" I think so. It's a private network.
    – user150198
    Mar 30, 2016 at 11:48
  • schroeder: Thank you very much for taking the time to respond again. "If you look on Openwall's site, you will see that they have their own version of Linux: openwall.com/Owl THAT'S what you scanned, and it's that machine's telnet you scanned." I own no machines with Linux installed. Unless I plug in my wifi router to the modem, I should be the only machine using the router. That Openwall GNU/*/Linux telnetd shows up with or without the wifi router connected.
    – user150198
    Mar 30, 2016 at 12:07

2 Answers 2

Reset to default
1

Your question is a little unclear (and I don't have the reputation required for comments) so I'll assume that what you're referring to is having scanned your default gateway IP Address from inside your local network.

If that is the case then what you are seeing is likely just a telnet service which can be used to manage your router and this on its own would not be cause for concern, as it's a common port used for that purpose.

The reference to openwall will be based on the banner returned by the service when zenmap connected to it. you can test this by using a telnet client and connecting to your gateway IP address.

As the comments have noted, whilst openwall does product the john password cracking software, it does also produce linux software called OwL http://www.openwall.com/Owl/ which includes a telnet server.

One other point is that if you need to adminster your router/modem you should ideally use SSH rather than telnet......

Improve this answer
2
  • Thank you for the thorough response, A_Learner. Yes, as you surmised, I entered the default gateway IP (that was coughed up by running "ipconfig" in cmd) into the Target field of zenmap. I think it's my local network. My Windows 10 network is set to private, and I made my PC Set to Discoverable so I can use my Android as a remote. I've never installed ANY openwall product directly though. Hmm, unfortunately, I don't know how to use a telnet client or connect it to my gateway IP add. Heh, I know nothing of telnet or SSH...I'm sorry about all this, I could've sworn I mentioned I am newb...
    – user150198
    Mar 30, 2016 at 12:51
  • Might you know of a way to make sure that this telnet service is related to/employed by my ISP (its modem or whatever) and not some network savvy unknown party in the apartment snaggin' one of my ports?
    – user150198
    Mar 30, 2016 at 13:10
-1

You didn't scan your system. Run a local scan by giving local host (127.0.0.1) address in your scanner. It gives best results about ports.

For more effective results, you can use Belarc Software to know which software you have installed.

If you scan your default gateway, then the target is your modem/router. If you scan default gateway which was presented in your modem/router then your target becomes your ISP.

Improve this answer
8
  • 1
    That does not show the ports open on the internet-facing interface but localhost.
    – Tobi Nary
    Mar 29, 2016 at 16:02
  • Venkatesh, thank you for that info. Yes, I believe I did scan my "default gateway" according to cmd's "ipconfig" at least. I've used Belarc before. What software should I check for using it if I want to find out who/what is using my modem?
    – user150198
    Mar 30, 2016 at 12:22
  • You can observe the connections by observing SYSLOG of a router/switch. If you want to restrict the network access who are trying to connect, then you can use MAC Address Filter.
    – Venkatesh Chinta
    Mar 31, 2016 at 9:12
  • Is it home network or office network? If it is office network you can use Splunk (free upto 500mb) or any other syslog monitoring software (In this you have to enable syslog service). If it is home purpose you can look at logs tab in the router/switch.
    – Venkatesh Chinta
    Mar 31, 2016 at 9:24
  • Venkatesh Chinta: Thanks again for your help! It's a home network. I'll look into how to add mac address filters.
    – user150198
    Mar 31, 2016 at 12:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .