Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I just did a portscan on my parents router from the outside with nmap. (outside means I ssh'ed to my server and nmap'ed back to the routers external ip from that server)

 ~ $ sudo nmap -Pn xx.xx.xx.xxx

Starting Nmap 5.51 ( http://nmap.org ) at 2012-04-14 15:11 CEST
Nmap scan report for foo.bar.blabla.xx (xx.xx.xx.xxx)
Host is up (0.017s latency).
Not shown: 997 filtered ports
PORT     STATE  SERVICE
81/tcp   open   hosts2-ns
113/tcp  closed auth
1723/tcp open   pptp

pptp and auth are intended and known ports, but I have no idea what hosts2-ns is. I googled for it, but all I found was further detail on its name (hosts to nameserver) which was pretty obvious and that tt was also used as alternative port for http (80). And some other site told that port 81 is a favourite port for some malware.

So what is the practical use for hosts2-ns or which application on the router is it needed for? There is no port forwarding active on that port. (edit: wrong actually)

The router is a Draytek Vigor2200E-plus. It is used for some LAN-LAN stuff and VPN.

Edit:

When I try to connect to it with a browser xx.xx.xx.xxx:81 I get asked for a username and password (no html, just a window opening), but the username and password used to access the router does not work. Service scan nmap -Pn xx.xx.xx.xxx -sV showed David WebBox httpd 12.00a.0773. I know that program, it is some mail software my fathers business uses. But I wonder how it managed to open the port, UPnP is not active.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

nmap is telling you that port 81 is open, not what service is running on port 81. hosts2-ns is simply the name nmap has it referenced as (possibly from the /etc/services file on the machine you are running nmap from).

The real question is why is it open, and what is behind it. There are a few options:

  1. It has been defined in the Draytek as a forwarded port and leads somewhere to the internal networks (check the port-forwarding rules)
  2. It is being responded to by the Draytek itself (check for remote management configuration)
  3. There is something in between that is responding on behalf of the router. This is fairly unlikely, but there maybe a transparent cache in between doing something weird

Your first point of investigation is the router itself, given that nmap is saying the port is open, something must have responded to its probe.

share|improve this answer
    
no port forwarding active, this is what made me wonder at first. check my edit, its some sort of mail software but I have no idea how it managed to open the port as UPnP is deactivated. –  Baarn Apr 14 '12 at 14:00
    
I doubt you could get a privileged port to open with upnp anyway. So it is definitely a port forward, yet not in the draytek config. Does it have a DMZ option? –  Paul Apr 14 '12 at 14:06
    
I did not know the router even had the option for a DMZ, but actually there is a port forwarding rule active which I somehow managed to overlook. Found it in some comparison of all active forwards. –  Baarn Apr 14 '12 at 14:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.