Project Case Study
I scanned an old router I own from its local network, documented exposed TCP services, and identified settings for follow-up review.
I used Nmap on my MacBook while connected to the router. This kept the Proxmox server available on my main network.
Testing machine: MacBookTooling: Terminal, Nmap 7.99, web browserTarget device: Old ISP-provided DOCSIS gateway/routerRouter IP: 10.0.0.1Laptop IP: 10.0.0.239Interface: en0Network: 10.0.0.0/24
route -n get default.ifconfig.10.0.0.1.The router responded on several TCP ports; most scanned ports were filtered. A filtered result means Nmap could not determine whether the port was open or closed.
nmap 10.0.0.153/tcp open domain80/tcp open http443/tcp open https49152/tcp open unknown996 filtered tcp ports
A targeted service scan identified DNS on port 53 and a router administration service on ports 80 and 443. Nmap reported the web service banner as Xfinity Broadband Router Server, while the browser login page displayed the Helix/Videotron gateway interface. Several
commonly risky services, including FTP, SSH, Telnet, SMB, AFP, and alternate web administration ports, appeared filtered during the
targeted scan.
nmap -sV -p 21,22,23,53,80,443,445,548,1900,5000,8080,8443,8888 10.0.0.153/tcp open domain dnsmasq 2.8380/tcp open http Xfinity Broadband Router Server443/tcp open ssl/https Xfinity Broadband Router Server21/tcp filtered ftp22/tcp filtered ssh23/tcp filtered telnet445/tcp filtered microsoft-ds548/tcp filtered afp1900/tcp filtered upnp5000/tcp filtered upnp8080/tcp filtered http-proxy8443/tcp filtered https-alt8888/tcp filtered sun-answerbook
Assessment Results
DNS and web administration were reachable locally, along with unidentified TCP port 49152. Filtered ports need cautious interpretation; this scan did not establish WAN exposure or overall router security.
Finding 1
Evidence: 53/tcp open domain dnsmasq 2.83
Risk / meaning: This is expected for a router, but the DNS service should remain limited to the local network.
Recommendation: Keep DNS service internal and avoid exposing router services to the WAN.
Finding 2
Evidence: 80/tcp open http
Risk / meaning: Local users can reach the router login surface over HTTP.
Recommendation: Use a strong admin password and prefer HTTPS administration where supported.
Finding 3
Evidence: 443/tcp open ssl/https
Risk / meaning: A TLS-enabled administration service was detected; certificate and TLS configuration were not assessed.
Recommendation: Use HTTPS for management and disable remote administration if available.
Finding 4
Evidence: 49152/tcp open unknown
Risk / meaning: This requires follow-up enumeration before deciding whether it is expected or unnecessary.
Recommendation: Run targeted service detection against port 49152 and document the result.
Positive observation
Evidence: FTP, SSH, Telnet, SMB, AFP, UPnP-related TCP ports, and alternate admin ports were filtered.
Risk / meaning: These probes could not determine whether the ports were open or closed.
Recommendation: Keep unused services disabled and review UPnP, WPS, and remote management settings.
Challenge
I used macOS for the scan to avoid disconnecting Proxmox from its management network.
Troubleshooting
A failed command, nmap -sv, helped confirm that Nmap options are case-sensitive. The correct command is
nmap -sV.
Clarification
I learned that ping -p 53 on macOS does not test port 53. It changes the ICMP payload pattern, while Nmap was the correct
tool for identifying port 53 as an exposed DNS service.
Value
This project demonstrates practical network reconnaissance, local gateway enumeration, command-line troubleshooting, and security documentation while keeping testing scoped to owned equipment in a controlled environment.
Command Log
These commands were run only against my own router on my local lab network.
Confirmed that Nmap was installed and available from the terminal.
nmap --version
Identified the default gateway used by the laptop while connected to the old router.
route -n get default
Confirmed the active interface, local IP address, and subnet details.
ifconfig
Verified that the router gateway responded before running service enumeration.
ping 10.0.0.1
Scanned common TCP ports on the router gateway.
nmap 10.0.0.1
Identified services and versions on selected router-relevant ports.
nmap -sV -p 21,22,23,53,80,443,445,548,1900,5000,8080,8443,8888 10.0.0.1
Evidence
The local test setup, gateway discovery, and Nmap results.
Next Stage
Run nmap -sV -p 49152 10.0.0.1 to determine whether the exposed high port is expected router behaviour.
Check firmware version, WPS, UPnP, remote management, firewall settings, wireless encryption, and admin password status.
Apply safe hardening changes, then re-run the scan to compare the exposed service profile before and after remediation.