0

Ran a port scan against my WiFi router (Trendnet TEW-633GR), found this:

PORT      STATE SERVICE
80/tcp    open  http
8456/tcp  open  unknown
8832/tcp  open  unknown
54321/tcp open  unknown

Port 80 is the web admin interface, which is fine.

Port 54321 speaks SOAP, apparently implementing something called HNAP (hnap.org seems down; Wikipedia knows something about it: http://en.wikipedia.org/wiki/Home_Network_Administration_Protocol)

Both ports 8456 and 8832 seem to speak HTTP, but I can't get them to return anything other than 500 Internal Error. Any idea what they might be for, or how to get them to say something more intelligent?

(No, I don't like devices on my network that have open ports that I don't know about)

Improve this question
1

1 Answer 1

Reset to default
0

Does the router have any media server capabilities. 8456 & 8832 could be a streaming server.

54321 sounds like a port opened dynamically from a device on your LAN. Possibly via uPNP.

Improve this answer
2
  • Not that I know. What would the protocol be? And 54321 seems to be HNAP not uPNP.
    – Johannes Ernst
    Commented Feb 20, 2014 at 20:52
  • Anything over 10000 could be a dynamically opened port. uPNP allows dynamic port requests from client devices to make connectivity easy. The uPNP service in the router will respond to the request by opening a high numbered, free, port and sending the port number back to the client. What the port is used for is different to uPNP which is about negotiation not communication. That port can also be used for the loadavg service and several trojans.
    – Julian Knight
    Commented Mar 5, 2014 at 10:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .