1

I have a device and I am trying to port scan it. I did the basic nmap -A -p0- 192.168.0.x but I am just getting 0/tcp filtered unknown so I don't think it is working. The device works on p2p so I am thinking that is why it may not be working. I read that p2p does not use ports but I don't even know how that works or is possible.

I do know it has to have some port open because I can connect to it through my phone and secondly when I wiresharked my phone while it is connected to the device I can see that multiple packet's are being exchanged on my LAN (Because I am seeing my phone 192.168.0.x and the device 192.168.0.x exchanging packets) on port 40123.

So what can I do here, my goal is to understand how the communication works so I can replicate it and code my own functionality into it and make sure my devices are secure.

3
  • "I read that p2p does not use ports ...." - whatever you've read, please cite the reference to get the context - or leave it out of the question if it is not relevant. *" Commented Oct 7, 2022 at 5:47
  • @SteffenUllrich your right my apologies, " Not only do most P2P networks now operate on top of nonstandard, custom- designed proprietary protocols, but also current P2P clients can easily operate on any port number, even HTTP's port 80." conferences.sigcomm.org/imc/2004/papers/p121-karagiannis.pdf Commented Oct 7, 2022 at 7:14
  • "... operate on any port number ..." is very different from "... does not use ports ...". It just means that it does not use fixed standardized port numbers - see also my answer for a deeper explanation. Commented Oct 7, 2022 at 8:28

1 Answer 1

2

The device works on p2p ...

P2P just means that devices might connect directly without an external third party involved in the communication. There are lots of different P2P technologies but often the help of a third party is needed to establish the direct communication.

For example with VoIP (SIP, H.323, WebRTC, ..) media like audio or video is tried to be exchanged directly between devices, i.e. P2P. But before that the information how these devices can be reached are exchanged inside a control channel using some third party or by broadcasting the information inside the local network. Direct communication is usually done in such cases using randomly opened ports and information which ports are opened for the session are exchanged using Session Description Protocol or similar.

It is unclear what P2P technology is used in your specific case. But if nmap does not report anything it is likely the device does not simply has ports permanently open for others to connect, but only opens randomly chosen ports on demand if a communication should be established. And once this connection is established it will be restricted to communication with the peer, i.e. no open port visible from other source IP. This would explain that no open ports show up when scanning.

4
  • Oh I did not even know devices could make ports invisible from other sources. Thanks for clearing this up for me I had a hard time finding clear information online.😁 Commented Oct 7, 2022 at 7:17
  • @AskedSuperior: They don't explicitly "make ports invisible". It is just that the socket is connected to a specific peer and thus only accepts packets from this peer. I recommend that you get a deeper understanding of TCP, UDP, sockets, connected vs. unconnected sockets etc. Commented Oct 7, 2022 at 8:30
  • Thanks for suggestion, I have recently been creating socket servers in C and mips to better understand them. Given what you said however I have a theory. After connecting from my phone(to establish the private connection) could I just imitate my phone private ip addr with outgoing packets from my computer so that the device would "accept" these packets. I am thinking either spending the time to modify raw packet heads or learn how to edit my router NAT to do this, would this be worth the time? Hopefully modify raw packet as in the real world I wont be able to always modify NAT. Commented Oct 7, 2022 at 17:44
  • @AskedSuperior: while one could try to send a packet to the phone with a spoofed IP address I'm not sure it will help much. Like I said, with many p2p protocols the ports used for the actual data transfer are random and the sockets are only there if data should be transferred. So if no transfer is done there would be no visible ports. And within different transfers the ports might change - so the information about the ports might not be useful for long. Commented Oct 7, 2022 at 18:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .