I'm running Zenmap
on my Windows 7 laptop. I ran an intense scan with UDP targeting my router 192.168.1.1
.
I realize that I'm probing into the back end of the router from the inside and that any open ports are nothing to be concerned about.
At the time, my iPod (on standby/not turned on) and my laptop were the only connected devices.
In the left-hand window under HOSTS (OS / Host) I have two entries:
- host 2-96--.as13285.net(2.96.*.""") - (I've hidden some numbers as *)
- 192.168.0.1
With host 2-96....
highlighted, and the Ports/Hosts tab in the right window selected, I see 21
,22
,23
,443
all filtered and 80
, 631
(IPP) open.
However, if instead I now highlight 192.168.1.1
, I see two more services listed, both UDP, and both open: 53
and 1900
(UPnP)
My questions are:
Given that my external IP address
(2-96-*-*)
and192.168.1.1
are exactly the same device (the router), why do I see 2 extra services (granted they are UDP) if I look at the192.168.1.1
scan?I envisage the NAT and firewall systems as sitting in the middle of the router, between the front end and the back end.
And thinking that the back end of my router is waiting to receive any traffic from any possible port inside my network, I would not have been surprised if the scan had said all65000
ports are open or at least listening/filtered (I know that"listening"
is not a state NMAP recognises).
So what's so special about the 6/8 ports/services that are detected and why aren't all65000
found in one way or another?