Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 117 guests and 2 members online
EH-Net News Feeds
Latest Additions
 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Network Pen Testingarrow Apple Airport Basestation Extreme Port Scan Always Shows 7070 554 21
EH-Net
May 26, 2012, 04:08:22 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Advertise on EH-Net!! - Reasonable Rates, Highly Targeted Audience.
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Apple Airport Basestation Extreme Port Scan Always Shows 7070 554 21  (Read 4106 times)
0 Members and 1 Guest are viewing this topic.
cd1zz
Sr. Member
****
Offline Offline

Posts: 393


View Profile WWW
« on: January 26, 2011, 06:09:44 PM »

This is a problem I've had for years and never found a solution. I have an AEBS and whenever I do a portscan outside of my network it ALWAYS shows ports 7070 554 and 21 open, even when the host doesnt have those ports open. When I replace my AEBS with a regular Linksys router, these ports dont show up in my nmap scans. It's very strange.

I've only found a few posts talking about it but never any solutions. http://discussions.apple.com/message.jspa?messageID=7252565

Anyone else use an AEBS and experience the same behavior? I've tried wiping the device and starting fresh, I'm also running the latest firmware. When looking at a packet capture, you actually see the TCP handshake complete. Any other folks have this problem? Did you fix it?
Logged

Andrew Waite
Hero Member
*****
Offline Offline

Posts: 857



View Profile WWW
« Reply #1 on: January 27, 2011, 03:34:35 AM »

I don't use AEBS, but I have seen similar problems when scanning through other devices. Unfortunately only options I've found are:
  • Accept that the ports are a false positive (& possibly ignore an actual positive)
  • Replace the hardware, as you've tried
  • Shift scanning source to outside of the device causing issues (not always an option)

If anyone has a better solution, I'd also welcome the advice.
Logged

cd1zz
Sr. Member
****
Offline Offline

Posts: 393


View Profile WWW
« Reply #2 on: May 26, 2011, 09:01:46 PM »

BTW - I still havent found a solution for this problem and have read in multiple places that it is an issue for others.

My workaround has been to put the AEBS in bridge mode and use another device for my FW/NAT. It's an extra hop in my network but at least I get accurate results until they fix it!
Logged

hell_razor
Jr. Member
**
Offline Offline

Posts: 83


View Profile
« Reply #3 on: May 27, 2011, 01:19:07 PM »

Hack naked! - PaulDotCom

Seriously.

It is likely that the device is proxying on one or all of these ports for some reason.  To verify, capture traffic before and after device and see what it looks like.  Also, set your http proxy and/or SOCKS proxy settings to your device IP address and see if it translates.  Just guessing here, no direct experience with that device.
Logged

A+, Network+, Server+, CISSP, GSEC, GCIH, GPEN, GCIA, GISP, GCFW
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.16 | SMF © 2011, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.116 seconds with 23 queries.
 

gk_static-ad_feb2012.jpg
Global Knowledge: Build Security Skills to Protect & Defend

els_130x200fixed2.gif
eLearnSecurity Student Course Now Live!
5% Off with Code
ELS-EH-5

SANS Deals 4 EH-Netters
$150 OFF Any SANS Course in Any Format!
Coupon Code: EHN_Connect Including SANS Security West 2012 & SANSFIRE 2012
Recent Forum Topics

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!

Vote For EH-Net

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2012 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.