my nmap scan

toString · 10 Jul 2006 at 11:26

I was doing a scan from the office to my router at home.

Warning: OS detection will be MUCH less reliable because we did not find at least 1 open and 1 closed TCP port
Interesting ports on ##############(########):
Not shown: 1678 filtered ports
PORT STATE SERVICE VERSION
5190/tcp open aol?
6881/tcp open bittorent-tracker?

BT is ok, as I opened that one...
But what on earth is that other one? I haven't opened that. I don't even have any AOL products installed.

upnp is disabled on the router too.

Any ideas?

branddaly · 10 Jul 2006 at 11:41

AIM ? you could run netstat -a on your home PC and see what has that port open.

FordPrefect · 10 Jul 2006 at 11:41

Maybe you came across an open session as the port is greater than 1024. I'd suggest that you retry the scan.

toString · 10 Jul 2006 at 12:23

Nope no AIM.
I tried the netstat, and nothing is using port 5190. I tried nmap again, and it's still there too.
This is all very strange :/

I'm using it like this:

nmap -A -T4 -P0 ###########

bitslice · 10 Jul 2006 at 13:07

W32.HLLW.Anig worm ?

toString · 10 Jul 2006 at 13:12

Quick google shows that said virus could open the port... good call!
Trouble is, I have NOD32 installed :/

I also have a windows 2003 server box too, for the record. Should I install NOD32 on there? Seems an unlikely place to get a virus, but I suppose I'll try it later..

FordPrefect · 10 Jul 2006 at 13:21

KingAdora said:
Nope no AIM.
I tried the netstat, and nothing is using port 5190. I tried nmap again, and it's still there too.
This is all very strange :/

I'm using it like this:

nmap -A -T4 -P0 ###########

Dont forget that if you have a session going through the router then you might actually be seeing the port of the outgoing session. Like I said try rescanning later, also it might be worth running nessus against that port and see if it can figure out exactly whats running on that port.

toString · 10 Jul 2006 at 13:38

Thanks for the tip, I'll try later. I'll also try rebooting the router tonight and trying again tomorrow.
Not sure what you meant by this:
"Maybe you came across an open session as the port is greater than 1024"

Do ports below 1024 close quicker or something?
Sorry bit of a noob on this...

mike1210 · 10 Jul 2006 at 13:56

KingAdora said:
Do ports below 1024 close quicker or something?
Sorry bit of a noob on this...

They are service ports wheras the ports above 1024 are client ports, service ports provide a service i.e internet website, FTP connection, Newsgroups..... wheras client ports are something you use to connect to that service i.e a port above 1024 would be used to connect to a website that runs on port 80