I run my own (Ubuntu based) router and have
iptables configured to drop all incoming packets by default. To my surprise, running an
nmap scan (from the WAN side) shows two open ports related to VOIP:
nmap -Pn -v --reason XXX.net Starting Nmap 7.60 ( https://nmap.org ) at 2018-03-28 09:52 CEST Initiating Parallel DNS resolution of 1 host. at 09:52 Completed Parallel DNS resolution of 1 host. at 09:52, 0.09s elapsed Initiating Connect Scan at 09:52 Scanning XXX.net (XXX.XXX.XXX.XXX) [1000 ports] Discovered open port 21/tcp on XXX.XXX.XXX.XXX Discovered open port 22/tcp on XXX.XXX.XXX.XXX Discovered open port 5060/tcp on XXX.XXX.XXX.XXX Discovered open port 2000/tcp on XXX.XXX.XXX.XXX Completed Connect Scan at 09:52, 5.17s elapsed (1000 total ports) Nmap scan report for XXX.net (XXX.XXX.XXX.XXX) Host is up, received user-set (0.035s latency). Not shown: 995 filtered ports Reason: 995 no-responses PORT STATE SERVICE REASON 21/tcp open ftp syn-ack ttl 52 22/tcp open ssh syn-ack ttl 54 113/tcp closed ident reset ttl 254 2000/tcp open cisco-sccp syn-ack ttl 61 5060/tcp open sip syn-ack ttl 61 Read data files from: /usr/local/bin/../share/nmap Nmap done: 1 IP address (1 host up) scanned in 5.33 seconds
ssh are correct, as these two services are configured on the router. But
sip being open is news to me.
telnet connection to both ports is successful:
telnet XXX.net 2000 Trying XXX.XXX.XXX.XXX... Connected to XXX.net. Escape character is '^]'. telnet XXX.net 5060 Trying XXX.XXX.XXX.XXX... Connected to XXX.net. Escape character is '^]'.
netstat -talpn on the router while the
telnet session is active shows no established connection for either port. And the log shows that
iptables drops the packets:
Mar 27 20:52:16 router DROP INPUT IN=ppp0 OUT= MAC=MM:MM:MM:M SRC=YYY.YYY.YYY.YYY DST=XXX.XXX.XXX.XXX LEN=60 TOS=00 PREC=0x00 TTL=51 ID=39215 DF PROTO=TCP SPT=52200 DPT=2000 SEQ=106277563 ACK=0 WINDOW=42340 SYN URGP=0 MARK=0
YYY.YYY.YYY.YYY is the IP that
telnet connects from.
Is my diagnosis correct?
If yes, how can
telnet establish a connection, even though the packets are dropped at the router? Who is listening on ports 2000 and 5060?
--reason -vto your Nmap scan to see TTL differences in the SYN ACK response packets received. It is possible that something else is responding/intercepting on these ports.
netstat -talpnu- run it with
telnetsessions, the reasons are successful TCP handshakes. I also looked at the XML output, and get reason_ttl="0" for all open ports (which I don't understand). Furthermore, doing two nmap scans, one for 22/tcp and one for 2000/tcp, the round trip times are similar.