Why does my Belkin wireless router has eMule port open?

Question

I have a Belkin F6D4230-4 v1 router. When I port scan it with nmap I get the following:

$ sudo nmap -sS -A -T5 192.168.2.1 -p-

Starting Nmap 5.00 ( http://nmap.org ) at 2010-04-17 11:40 CDT
Interesting ports on 192.168.2.1:
Not shown: 65532 closed ports
PORT     STATE    SERVICE VERSION
80/tcp   open     http    Belkin 2307 wifi router http config (IP_SHARER httpd 1.0)
|_ html-title: '+i1+'
4661/tcp filtered unknown
4662/tcp filtered edonkey
MAC Address: 00:22:75:5D:52:D8 (Belkin International)
Device type: WAP|broadband router|firewall|printer|specialized|webcam
Running (JUST GUESSING) : Linksys embedded (95%), TRENDnet embedded (95%), Netgear embedded (92%), Canon embedded (89%), On Time RTOS (89%), Symantec embedded (89%), D-Link embedded (86%), Polycom embedded (85%)
Aggressive OS guesses: Linksys WRT54GC or TRENDnet TEW-431BRP wireless broadband router (95%), TRENDnet TW100-BRF114 broadband router (95%), Netgear FR114P ProSafe VPN firewall (92%), Canon PIXMA MX850 printer (89%), On Time RTOS (89%), Symantec Firewall/VPN 100 (89%), D-Link DI-714P+ wireless broadband router (86%), Polycom ViewStation video conferencing system (85%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hop
Service Info: Device: WAP

OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.57 seconds

Why are the 4461 and 4462 ports open? This is a basic, out-of-the-box installation.

Answer 1

When NMap runs a scan and reports back to you what ports are open it consults a general list of what services are associated with the port(s) which are open. In this case port 4662 is most commonly used for edonkey. It doesn't mean necessarily that your router is using edonkey, just that the port is most commonly used for that.

The one other possibility is that someone with access to the router has forwarded a port, so that they could access edoneky inside your network. Check the settings on the router to find any mapped/forwarded ports and it should say which IP it is forwarding to.

Answer 2

Are you using dynDNS (clients use 4661 and 4662 ports) on your router? If so then that is why, if not you may have another issue...

Answer 3

I have a newer Belkin router and it also has port 4662 open by default. When Alex mentioned DynDNS up above it all made sense. My router supports Dynamic DNS services through dyndns.com. I imagine this port simply allows that functionality so you can setup an address to access your router / forwarded devices without having to know your exact IP address.

Answer 4

Nmap gives funky reports when you are doing a local scan. True test is to have someone else scan the port. Try GRC Shields Up and scan that port specifically, then you will know what the real situation.