I run my own (Ubuntu based) router and have iptables
configured to drop all incoming packets by default. To my surprise, running an nmap
scan (from the WAN side) shows two open ports related to VOIP:
nmap -Pn -v --reason XXX.net
Starting Nmap 7.60 ( https://nmap.org ) at 2018-03-28 09:52 CEST
Initiating Parallel DNS resolution of 1 host. at 09:52
Completed Parallel DNS resolution of 1 host. at 09:52, 0.09s elapsed
Initiating Connect Scan at 09:52
Scanning XXX.net (XXX.XXX.XXX.XXX) [1000 ports]
Discovered open port 21/tcp on XXX.XXX.XXX.XXX
Discovered open port 22/tcp on XXX.XXX.XXX.XXX
Discovered open port 5060/tcp on XXX.XXX.XXX.XXX
Discovered open port 2000/tcp on XXX.XXX.XXX.XXX
Completed Connect Scan at 09:52, 5.17s elapsed (1000 total ports)
Nmap scan report for XXX.net (XXX.XXX.XXX.XXX)
Host is up, received user-set (0.035s latency).
Not shown: 995 filtered ports
Reason: 995 no-responses
PORT STATE SERVICE REASON
21/tcp open ftp syn-ack ttl 52
22/tcp open ssh syn-ack ttl 54
113/tcp closed ident reset ttl 254
2000/tcp open cisco-sccp syn-ack ttl 61
5060/tcp open sip syn-ack ttl 61
Read data files from: /usr/local/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 5.33 seconds
ftp
and ssh
are correct, as these two services are configured on the router. But cisco-sccp
and sip
being open is news to me.
Indeed, a telnet
connection to both ports is successful:
telnet XXX.net 2000
Trying XXX.XXX.XXX.XXX...
Connected to XXX.net.
Escape character is '^]'.
telnet XXX.net 5060
Trying XXX.XXX.XXX.XXX...
Connected to XXX.net.
Escape character is '^]'.
But running netstat -talpn
on the router while the telnet
session is active shows no established connection for either port. And the log shows that iptables
drops the packets:
Mar 27 20:52:16 router DROP INPUT IN=ppp0 OUT= MAC=MM:MM:MM:M SRC=YYY.YYY.YYY.YYY DST=XXX.XXX.XXX.XXX LEN=60 TOS=00 PREC=0x00 TTL=51 ID=39215 DF PROTO=TCP SPT=52200 DPT=2000 SEQ=106277563 ACK=0 WINDOW=42340 SYN URGP=0 MARK=0
where YYY.YYY.YYY.YYY
is the IP that telnet
connects from.
Is my diagnosis correct?
If yes, how can telnet
establish a connection, even though the packets are dropped at the router? Who is listening on ports 2000 and 5060?
--reason -v
to your Nmap scan to see TTL differences in the SYN ACK response packets received. It is possible that something else is responding/intercepting on these ports.netstat -talpnu
- run it withroot
telnet
sessions, the reasons are successful TCP handshakes. I also looked at the XML output, and get reason_ttl="0" for all open ports (which I don't understand). Furthermore, doing two nmap scans, one for 22/tcp and one for 2000/tcp, the round trip times are similar.