Listening ports

[johnnyboy]

By using netstat, I found router were listening to the following ports:

tcp        0      0 0.0.0.0:5473            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:18017           0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:3394            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:515             0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:9100            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:9998            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:53489           0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:8082            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:3838            0.0.0.0:*               LISTEN

Does anyone know which program using these ports ? Are these ports normal?

Thanks.

 

[johnnyboy]

udp        0      0 0.0.0.0:9999            0.0.0.0:*                           
udp        0      0 0.0.0.0:42000           0.0.0.0:*                           
udp        0      0 0.0.0.0:67              0.0.0.0:*                           
udp        0      0 0.0.0.0:5474            0.0.0.0:*                           
udp        0      0 0.0.0.0:18018           0.0.0.0:*                           
udp        0      0 0.0.0.0:1900            0.0.0.0:*                           
udp        0      0 0.0.0.0:38000           0.0.0.0:*                           
udp        0      0 0.0.0.0:56953           0.0.0.0:*                           
udp        0      0 0.0.0.0:1194            0.0.0.0:*                           
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           
udp        0      0 0.0.0.0:43000           0.0.0.0:*

 

[hggomes]

UPNP ON? If not take a look at the source code and see what services are running on those ports.

Or you can simply close them

/release/src/router/rc/firewall.c

PORT: 18017
=========

release/src-rt/router/rc/wanduck.h:#define DFL_HTTP_SERV_PORT "18017"

if (nvram_get_int("web_redirect") > 0)
release/src-rt/router/rc/firewall.c: fprintf(redirect_fp, "-A PREROUTING ! -d %s/%s -p tcp --dport 80 -j DNAT --to-destination %s:18017\n", lan_ipaddr_t, lan_netmask_t, lan_ipaddr_t);

strcat_r(nvram_safe_get("lan_ipaddr"), ":18017", tmp));


PORT: 9998
=========

release/src-rt/router/lighttpd-1.4.29/doc/config/conf.d/scgi.conf:# "port" => 9998,
release/src-rt/router/shared/iboxcom.h:#define OTSPORT 9998
release/src-rt/router/netatalk-3.0.5/libevent/test/regress_util.c: test_ai_eq(ai, "127.0.0.1:9998", SOCK_STREAM, IPPROTO_TCP);


If you make a portscan on all those ports you are going to see they are closed to the Internet.