I recently discovered nmap and pointed it at my router out of curiosity. It found that ports 3333 and 5555 are open but doesn't recognise either service. I investigated and found:

  • I can successfully make TCP connections on both ports.
  • On port 3333, after I connect the router sends '0NTP00-00-00MAC00-00-00-00-00-00'. Nothing I send it in response seems to trigger it sending anything else.
  • Port 5555 responds to HTTP GET / (plus any other HTTP query) with a simple 404 page [1]. If it's an HTTP server, why didn't nmap recognise it as such?

It doesn't look like the ports are accessible from outside the LAN.

I couldn't find any info about these ports on the web. Does anyone know anything about them? What techniques exist for investigating further?

[1]:<HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>Not Found</H1>The requested URL was not found on this server.</BODY></HTML>

closed as off-topic by schroeder, TildalWave, Xander, Graham Hill, NULLZ Nov 5 '14 at 14:27

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder, TildalWave, Xander, Graham Hill, NULLZ
If this question can be reworded to fit the rules in the help center, please edit the question.

  • What type of router and what firmware/software version? – cpt_fink Nov 4 '14 at 23:18
  • 1
    Netgear WNR2200, V1.0.1.88 – Brendan Nov 4 '14 at 23:22
  • 3
    Welcome to Info Sec. This isn't an info sec question but a question for the vendor's support. – schroeder Nov 5 '14 at 1:21
  • First Google hit: forum1.netgear.com/showthread.php?t=72944 – schroeder Nov 5 '14 at 1:22
  • @schroeder that thread points to another which you can't access (or at least I can't). – djsmiley2k Nov 6 '14 at 0:24