Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've got a Netgear DG834G running firmware V5.01.01. From the LAN side, if I port scan it, it's listening on tcp port 32764. Trying to telnet into this port gives me the response MMcS\xff\xff\xff\xff\0\0\0\0 (in hex, obviously).

I've got UPnP disabled, it's not a remote management port, and it's not open on the WAN side. I can't find anything in Netgear's documentation, and searching online doesn't find anything either. A few people seem to have noticed, but no one actually has an answer. I've also created a firewall rule blocking outbound access to that port, and it's still open, so it's actually the router that's listening on it.

Does anyone know what this could be?

share|improve this question
    
What telnet client are you using? When I use Putty all I get with my netgear router is "MMcSÿÿ"... –  Mokubai Jul 22 '10 at 22:15
1  
A y with double dots over it is hexadecimal 0xff, you're getting the same as me. –  Dentrasi Jul 23 '10 at 21:00
    
Just to add to this because I came across this recently, here's the output now: SF-Port32764-TCP:V=5.61TEST4%I=7%D=5/8%Time=4FA9A45B%P=i686-pc-linux-gnu%r SF:(GenericLines,C,"MMcS\xff\xff\xff\xff\0\0\0\0")%r(Help,C,"MMcS\xff\xff\ SF:xff\xff\0\0\0\0")%r(X11Probe,C,"MMcS\xff\xff\xff\xff\0\0\0\0")%r(LPDStr SF:ing,C,"MMcS\xff\xff\xff\xff\0\0\0\0")%r(TerminalServer,C,"MMcS\xff\xff\ SF:xff\xff\0\0\0\0"); Any more insight as to why this port is open by default would be nice. –  user133055 May 8 '12 at 22:57
2  
github.com/elvanderb/TCP-32764 –  Mike Jan 3 at 4:28
    
Since this device belong to you and you are on a LAN, Maybe you can try nmap -sV --version-all the_device_hostname. –  user2284570 Jan 4 at 1:52

2 Answers 2

up vote 2 down vote accepted

Hmm, weird.

Hex ff = Decimal 255, so logically the response you are receiving is equivalent to

MMcS 255.255.255.255 0.0.0.0 (dots added for networking clarity) which to me is basically a broadcast address on your network. It could be stating that any ip on your network can use the MMCS service, i.e. 255.255.255.255 net mask 0.0.0.0.

There are a number of things that MMCS could be, such as the MultiMedia Class Scheduler that Vista is able to use to get priority for multimedia traffic over the network. It would explain why the port is only open on your local network too.

Also a bit of info on point 5 of the first post of this page

I doubt it would be something to do with MIP-MANET Cell Switching which appears to be something to do with mobile phone networks. Wow there is some weird stuff that gets returned when you Google for MMCS 255.255.255.255. Like this.

So I'd say it's most likely a port that allows the Windows MultiMedia Class Scheduler to talk to the router to prioritize traffic, but it could be some weird funky mobile phone network stuff.

share|improve this answer

Actually, this appears to be a software back-door included by the manufacturer as described here and exploitable using this script.

So far non-vendor related persons have reported there are back-doors in the following routers: Linksys WAG200G, Linksys WAG320N (Firmware V1.00.12) and Netgear DM111P. But it seems the following devices (yours included) may also be present, Netgear DG834, DG834G WPNT834 DG934, WG602, WGR614 router, Linksys WAG160N and DGN2000, WAG120N wireless-WRVS4400N. It seems likely this back-door is present in other devices as well.

share|improve this answer
    
    
@D3C4FF : The thing which would be the most interesting, would be know what is the destination ip_address of the service, when it work normally. I'm curious to know which person automaticly colect the data. –  user2284570 Jan 4 at 3:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.