I've created an open guest network on my router (N600 Wireless Dual Band Gigabit Router Model No. TL-WDR3600 v1, 3.14.3 Build 150518 Rel.72050n). Internally nmap gives me:

Nmap scan report for
Host is up (0.041s latency).
Not shown: 992 closed ports
21/tcp    filtered ftp
22/tcp    filtered ssh
80/tcp    filtered http
139/tcp   filtered netbios-ssn
445/tcp   filtered microsoft-ds
1041/tcp  filtered danf-ak2
1900/tcp  open     upnp
49152/tcp open     unknown

I don't understand why any of the ports are listed. When I use nmap on my secure wifi network I see:

Nmap scan report for
Host is up (0.044s latency).
Not shown: 996 closed ports
22/tcp    open  ssh
80/tcp    open  http
1900/tcp  open  upnp
49152/tcp open  unknown

Didn't even know my router had ssh capabilities... Why is FTP showing on the guest network? How to find out what 49152 is?

  • 1
    I read the manual for your router, and it explains everything: downloads.netgear.com/files/WNDRMAC_UM_15Apr11.pdf You are seeing the 'Readyshare' options being open on the guest network. It explains the ftp, http, and ports 139 and 445. – schroeder Jan 15 '17 at 15:37
  • port 49152 is the SDDP - if you search "netgear port 49152" you will get lots to look through – schroeder Jan 15 '17 at 15:42
  • Thanks @schroeder, I'm too lowly to say thank you in any other way ;-) – Dan Bolser Jan 16 '17 at 11:55

These are open services on your network Port 49152: As the first port in the dynamic/private range (49152-65535), this port is commonly used by applications that utilize a dynamic/random/configurable port.

uTorrent, and Azureus/Vuze p2p torrent clients often use this port.

Apple Xsan Filesystem Access uses the dynamic/private range 49152-65535 as well.

| improve this answer | |

Are there any network services that you use? For example do you have a web server on your network? Do you ever use SSH to connect to a computer behind your router? If not you can disable NAT on ports 80 and 22 respectively. Here is a list of standard ports that you can use a reference. I would recommend looking up all ports that are showing on your network, and disabling all services that you don't use. The more ports you have open, the more potential attack vectors there are on your network, especially unfiltered ports.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.