Need help with GRC Port scan results

Topic

New Reply

I am using a router at a friends. Staying here for a couple days, so I checked the router on GRC before I started using it.  Most of the ports are closed with some open! I logged onto the router and everything looks OK. I’m familiar with the set up because I had a one of same brand. Firewall is set up properly.  I turned off UNPNP & WPS.  I don’t understand why the public IP address that’s being tested on grc shows closed (not stealth) & open ports. Can somebody help me understand? The Internet service is DSL, I don’t know if that makes a difference.

Reply | Quote

Replies

Is there a particular range the open ports are in?

Reply | Quote

There are 3 open ports in a row, five total open ports. Rest are closed except for a couple stealth. But this is interesting – I had done a UNPNP test which came back – No Response.  I had not logged onto the router yet and when I did I found UNPNP was not turned off!  So is it possible this address is on the ISPs router?  Which is still not good but how can it be this router? The firewall is on and when I had tested my router with the same firewall it came back all stealth.

I checked all devices on the network and there are two I don’t recognize.  The MAC addresses are: Delta electronics and Espessif.  I don’t know what Delta is.  Espressif  is a Chinese company that provide chips for IoT and Wi-Fi devices.

 

 

 

Reply | Quote

My ISP blocks some ports (closed, not stealth) related to SMB and NetBIOS.  So GRC’s portscans always show those particular ports as closed but not stealth – despite my home firewall configured to stealth those ports.

 

Reply | Quote

Can you post the port numbers that are not stealth?

cheers, Paul

Reply | Quote

Easier to say what IS stealth: 445, 135, 137-139. The rest are closed. Open: 443, 80, 21-23. All the rest closed.

Reply | Quote

443 and 80 are web server ports. You do not want them open.
Are you sure it’s the router and not something else on your network?

cheers, Paul

Reply | Quote

I don’t know. The IP address is what comes up on the test. I am not there now.  But it is a concern and my friend is not technical. : ( Thanks.  Donna

Reply | Quote

What router are they using?
Is it set to use web admin via the manufacturers web site?
Have they changed the admin password from the default?

cheers, Paul

Reply | Quote

Linksys Velop mesh.   I logged in via web, not Linksys app. I think remote access would be off.  My Linksys had no explicit option for that, I believe it would be on if you created an online account.

Yes, admin password for router was changed.

Also to your prior question, I had looked at all online devices on the network to identify them. I didn’t check the ip addresses.  There were a couple devices  that were unknown,  I was able to identify the manufacturer with the MAC address – Espressif IoT devices and Delta electronics – I figured they were some IOT devices like maybe the access points for the router.

Or the toaster : ) ha ha ha just kidding

I will be going back there in a couple weeks and can check things again. Donna

Reply | Quote

All devices on the network will have the same IP address – the router IP address.

On the router, turn UPnP off and see is that helps.

cheers, Paul

Reply | Quote

All devices on the network will have the same IP address – the router IP address.

oh yeah, right! UNPNP is off.  My first GRC test said it was off.  Then when I logged into the router, it showed it was on.  I turned it off and retested, but no change in the port test results.  These results are confusing to me, I don’t understand.  I’ll test again when I am back there.  Thanks for your suggestions.  Donna

Reply | Quote