Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So my question is much like this one, Port scan revealed port 1111 open. What is it?, but I wasn't able to investigate with the same techniques suggested here, because the device runs busybox. for example, netstat isn't an option.

I did an internal scan, with OpenVas, via OSSIM, and found this port open. It doesn't seem to be open from the outside. It also found port 22 open, which doesn't seem to be the case. At least I can't actually SSH to it.

I'm not super knowlegeable about any of this, but I do find it odd that my modem/gateway router should have services like this. Based on the link posted above, I wonder if my dsl company somehow uses, it? But I don't see any other hits about the actiontec and this port.

the model of the device is Model Number: Actiontec GT701-WG

share|improve this question
Do you have UPNP enabled? If so, port 1111 is open because one of your machines probably asked the router to open it. – David Schwartz Jul 29 '12 at 4:06
@DavidSchwartz The port is open from the inside, UPNP would open a port from the outside. – Scott Chamberlain Jul 29 '12 at 4:31
I don't think it's enabled. I don't see that options anywhere on the Gui. – AncientAnt Jul 29 '12 at 5:03
up vote 0 down vote accepted

If you are using a ISP's specific firmware that port could be anything as it is whatever Quest (that is the example of custom firmware that I found on Actiontec's website) wanted to put on that port. Also for port 22, just because you can't SSH in to it does not mean no-one can, they may be using certificate authentication, or maybe it is some other service that is just happening to use port 22.

One thing you can do is telnet to the ports in question and see if it responds when you connect or send various commands to it.

share|improve this answer
Thank you for you thoughts. I have tried to telnet, and no response on either port. I suspected something like the ISP having a port accessible, but it goes against my (very) limited understanding of how my LAN would be segmented from the ISP. A scan of my 192.168.x.x/24 is what revealed this to me. do you know of any other ways to see what service might be listening to this port on the modem? Netstat doesn't seem to be an option. – AncientAnt Jul 29 '12 at 5:11
EDIT: Actually telnet to 1111 does work. It seems like the same as telnet to 23, once I log in. sorry, I was originally testing with a telnet client on my phone , but that must not work they way I was expecting. – AncientAnt Jul 29 '12 at 5:23
The port is not for day to day use by the ISP, it is likely for diagnostic or firmware update purposes for when the device is sent in for maintenance. – Scott Chamberlain Jul 29 '12 at 5:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .