TCR100 port 52869 strange behavior

Hello,

I’m going to allow my TCR100 with firmware TCR1_R_00.07.06 to handle Internet traffic thru static IP.
But nmap reports that there is something strange going on port 52869

TEST:

nmap —reason myip
Enable SYN flood protection: off
TCP SYN cookies: off
WAN: MOB1S1A1

Two diffrent runs results:

Not shown: 999 closed tcp ports (conn-refused)
PORT      STATE    SERVICE REASON
52869/tcp filtered unknown **no-response**

Nmap done: 1 IP address (1 host up) scanned in 8.09 seconds
Not shown: 999 closed tcp ports (conn-refused)
PORT      STATE    SERVICE REASON
52869/tcp filtered unknown **host-unreach**

Nmap done: 1 IP address (1 host up) scanned in 7.11 seconds

Why I’m receiving diffrent resasons? This doesn’t happen on any other port!

Zrzut ekranu 2024-04-5 o 08.48.18

Hey Wojciech,

Could you check if netstat reports the port as actively listening? Use this command on the router to check - “netstat -ntlp”.

Your scan results are inconclusive. State is being reported as filtered, so there is no cause for alarm here - nmap reports the state as filtered for numerous reasons, such as the host being unreachable, or there being no response being heard back.

Hello,

Just to clarify - you have configured a port forward, but it does not work?
If so, could you attach the first two octets of your mobile/WAN interface IP? It would look similar to this:


Additionally, could you attach a screenshot of your port forward rule?

Best regards,

Hey,

Thanks for reply. Here are results of the command:

The device is running with default settings no port forwarding is configured.

Best regards,
W/.

Apparently nothing is listening on this port. If so then why this port doesn’t behave like those 999 closed ports?

W/.

The most likely reason for the scan behaviour would be the firewall - if I recall correctly, the firewall from the WAN side is set to DROP packets, hence the reason being host-unreach or no-response

As for the port, I would attribute it to how nmap does its scans - it probably reports all the other 999 ports as the same state, and uses port 52869 as an example.

Thanks for answer :slight_smile:

This topic was automatically closed after 15 days. New replies are no longer allowed.