I have performed several Nmap scans on my network to determine what devices are connected and which ports are open. To my surprise I found a very strange device connected(which I do not know physically where it is) and some devices have very suspicious ports open.
Below I will list the scans of the suspicious devices.
Nmap scan report for 192.168.1.1 PORT STATE SERVICE VERSION 23/tcp open telnet Cisco or Actiontec MI424WR router telnetd 80/tcp open http 443/tcp open ssl/https 992/tcp open ssl/telnet Cisco or Actiontec MI424WR router telnetd 8080/tcp open http-proxy 8443/tcp open ssl/https-alt
The above result is of my modem, the thing that is strange about it is that it has port 23 & 992 open. Whenever I log into my modem on the web user interface, I cannot see these ports open? I do have the option to open these ports, but they are unchecked. Which means it should be closed. So how can I close these ports?
Nmap scan report for 192.168.1.64 (Cisco Spvtg) Service Info: OS: Linux PORT STATE SERVICE VERSION 22/tcp open ssh Dropbear sshd 0.52 (protocol 2.0) 9001/tcp open tor-orport? 49152/tcp open upnp Portable SDK for UPnP devices 1.4.6-6 (Linux 2.6.31-3.3-isb6030; DLNADOC 1.50; UPnP 1.0)
The above scan is a device that I do not know where it is physically? It also has some very suspicious ports open? How can I identify this device? Should I try to kick it off my network?
Another scan that I cannot post currently, has an open port '12345 Netbus'? Is this some type of malware? The device is an android TV box. I will post the scan for this one later.
Thanks for helping :)