3

Every single machine I scan shows port 7070 and port 554 as open regardless if the ports are closed/filtered. It will still show those two ports as open even if the target is offline (and the scan is run without ping test).

Nmap tests all other ports fine and reports the expected states, it's just these 2 ports.

Improve this question
4
  • Could you post the command line parameters that you use? Could you also post the output of nmap -n -Pn -sS -p554,7070 --packet-trace --reason <targets>?
    – countermode
    Aug 21, 2014 at 23:20
  • Normally I'd use one of the pre-defined profiles in Zenmap f.e. nmap -T4 -A -v -Pn 75.27.30.143 Here's a pastebin of a few example targets which shouldn't have either port open. pastebin.com/g57DJvRu
    – Kesslo
    Aug 22, 2014 at 0:25
  • Since you're not in the same LAN as those machines, I guess that some gateway in between intercepts the packets on ports 554 and 7070. If I'm not mistaken you can find this out with traceroute -n -T -p554 75.27.30.143.
    – countermode
    Aug 22, 2014 at 5:36
  • This worked, turns out my router is intercepting packets for some reason.
    – Kesslo
    Aug 22, 2014 at 17:16

2 Answers 2

Reset to default
4

Certain routers intercept traffic on these ports, I can confirm that the BT Homehub does. I can telnet any_random_ip 7070 and get a connection.

Improve this answer
1
  • 2
    what is the purpose? is any service running on those ports?
    – beppe9000
    Sep 11, 2016 at 14:32
1

Various routers (Verizon FiOS, BT Home Hub, Apple Airport Extreme, ...) always show *:554 and *:7070 as open for some reason.

Hackerific » False positive TCP ports!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .