SAC2V1K router behind a Hitron EN2251 modem. ISP has precluded any local login for the router:
Performed an nmap scan of my public IP from outside of LAN and it indicates 1720/tcp open tcpwrapped
Per research that protocol is typically associated with the H. 323 teleconferencing. It could be a few different apps (none of which I have) or, as some suggest, a port left open on the ISP modem for video/audio streaming.
I've performed a netstat on devices and don't see any connections. Nothing outbound via computer firewall. I pulled up wireshark, ran a capture, and from my wireless USB dongle (connected to PC) I am seeing various ephemeral ports opening up and communicating from a local IP address on a different subnet than my network to my public IP address on port 1720. Mac address lookup provides no details (looked up online/checked router/modem). UPNP is off via router settings.
At this point I don't have any real worries about the network; it's more of a curiosity and I'm decidedly amateur at this. Is anyone able to provide insight or at least point me in the right direction as to the next step in order to confirm this has something to do with the ISP modem?
*edit:
Okay, I blame being in the middle of a fast, but really I'm just dumb:
I hadn't realized that I was running nmap while connected to a hotspot (to test from outside) and the packets I was observing from Wireshark was that transmission...
So that still leaves the question of 1720 being open/tcpwrapped. Any ideas?*
