1

I've run NMAP several times on my home network in my campaign of learning the basics of network security.

So far all my devices except my PC have been Iphones/Chromebooks so nothing has been found in the way of open ports and so on (Apart from a few clear ones i.e 443/80).

However, runnining Nmap today I've found these ports randomly opened on the macaddress + Ip address associated with an Iphone 6(IOS V.12.56) I have at home.

  • 1062/tcp filtered veracity
  • 1088/tcp filtered cplscrambler-al
  • 1105/tcp filtered ftranhc
  • 1217/tcp filtered hpss-ndapi
  • 2002/tcp filtered globe
  • 2006/tcp filtered invokator
  • 2323/tcp filtered 3d-nfsd
  • 4443/tcp filtered pharos
  • 5102/tcp filtered admeng
  • 6101/tcp filtered backupexec
  • 6346/tcp filtered gnutella
  • 7103/tcp filtered unknown
  • 18101/tcp filtered unknown
  • 26214/tcp filtered unknown
  • 44443/tcp filtered coldfusion-auth

Highly confused and wondering if anyone recognizes these ports for Iphone. Off the bat I see things like Gnutella and coldfusion, to name a few. Highly boggling.

Is it the case that Iphone has these specific ports configured. If so, why are they configured if anyone knows? I've referenced some ports with Apple's official statement on TCP/UDP ports [1] and none seem to match.

For comparison when doing a network scan on my Iphone 6s(another device), I dont get these results let alone any detection of ports (if I recall correctly, maybe I've seen 443/80 open)

5
  • 1
    Why do you think these are open? "Filtered means that a firewall, filter, or other network obstacle is blocking the port so that Nmap cannot tell whether it is open or closed. " See wiki.onap.org/display/DW/Nmap
    – Tetsujin
    Nov 19, 2021 at 8:25
  • I understand that its blocked, my question is rather why are they configured on the IOS device firstly. If they were not to be used they would closed permanently no? Like my scan on other devices like my chromebook and other Iphone will firmly state all ports to be closed save for essential ports like 443 or 80. Maybe i should RTFM hah
    – N S
    Nov 19, 2021 at 9:40
  • You don't know whether it's open or closed, that's the whole point. The ports are stealthed.
    – Tetsujin
    Nov 19, 2021 at 13:10
  • If you want to let us know with an edit what device runs your home network, we might be able to help with a setting to disable the filtering or explain the benefits of leaving it as configured.
    – bmike
    Nov 19, 2021 at 13:25
  • @Tetsujin Awesome thanks clears it up. To Bmike: Are you asking what the device being pinged is or what other devices are on my network
    – N S
    Nov 20, 2021 at 10:18

1 Answer 1

2

The ports are "filtered", which means nmap tried to send a packet to these ports but did not receive a reply. This is as it should be.

Why nmap is listing them like this at all depends on the arguments you have passed to nmap, AFAIK.

By contrast, the two other states are:

  • "open": With TCP, a SYN packet got at least an ACK answer back. That is, the other side answers a connection request.
  • "closed": An attempt to send a packet to that port was answered with an ICMP message informing the sender that the recipient is not accepting connections on this port.

With active firewall, you should see all ports as "filtered" and only those with an active (public) service as "open". You rarely see "closed", I think it's unlikely you're going to see it on an iPhone at all.

1
  • This confused me as well when networking installed some security tools and settings at work. It took me a short while to realize it just was nmap letting me know the network fabric itself was being manipulated, not that the targets I scanned had any open ports or changed. Shout out to everyone generating SIEM alerts and learning more about how things work.
    – bmike
    Nov 19, 2021 at 13:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .