Friday, July 27, 2018

Home router (ZyXEL EMG2926) listen on TCP port 263. Any tips to help me find out why?

I'm currently playing with Python network coding and I created a very simple scripts to port scan my home router.

I noticed TCP/263 is open (lan side) and I can telnet to it. When I hit enter the router sends me back some bytes... I have to evolve my script a bit to read those bytes.

Searching the web, I found out TCP/263 is used by HDAP (High-Availability Directory Access Protocol) which is odd. I suspect a backdoor or some suspicious things is going on.

Is there any tools or guidelines that could help me investigate this mysterious open port?



No comments:

Post a Comment