Curiosity About 2 Routers In IP Scanner Results

[PGB1]

Thank You Again all for your ideas & education. I'm learning quite a bit, with even more to learn. This is an interesting topic to me.

QUOTE: There should be a label on the back of the modem, however, that will list at least ONE of the above MAC addresses (probably not the Alien one). If you haven't checked already, that's an easy step.


I checked the label on the modem, Ember1205, and the address 5c:8f:e0:e7:61:is there three times, each with a different last two characters.
One titled CM MAC ends with BD. As far as my research could tell me, the "CM" means it is a cable modem.
The next on the label ends in BE and is titled E-MTA. The only information I found on E-MTA was from another ISP's help pages which stated it is for phone or television. Since my television system tees off ahead of the modem, I am guessing it is for telephone.
The third on the label ends in BF and is called WAN MAC. My guess? It is the WAN address the modem uses to communicate with the ISP. (A large guess on my part)

The one part that still makes me a bit uneasy is that Port 23 (telnet) is open and there is no place to close it. Pings are not showing as returned, so maybe it is not a problem.

 

[Ember1205]

Interesting...

I believe the "CM" does mean Cable Modem, and the "BD" MAC would be the one that it identifies itself as to the provider. This is the one that the provider uses to correlate a specific firmware file and to allow the cable modem to communicate on the network. Why -none- of the MAC's on the label match what you're seeing when communicating with the device from the "inside" or LAN side is a bit of a head scratcher for me.

Port 23 being open isn't something to be concerned about unless Port 23 is open to "the world" (outside) and it's actually a telnet service. You would need to run a scan against your cable modem's public IP Address from someplace outside of your home to determine whether that port is actually open and accessible without restrictions.

 

[PGB1]

Thanks for the good notes Ember1205.
For fun, I went to the library and tried to telnet into my Port 23. It was not successful, so that is reassuring.
My uneducated guess is Port 23 is used so the lessee can configure the router by WiFi and won't have to plug in an ethernet cable. Personally, I'd prefer the port to be closed & ethernet my way into the router configuration. But, such is life with a rented modem/router!

 

[Ember1205]

If the modem/router is designed to be "user configurable", it would most likely leverage port 80 for a web browser and not port 23 for telnet. The port 23 could be something entirely different, too, and not be for telnet at all (sometimes services are put onto atypical ports).

It's also possible that port 23 is open for the ISP to be able to access the device for a variety of reasons, and they would almost certainly have that port only available from their "management" devices and systems (which is why you can't get to it from the library).

With regard to accessing it from the library, did you try the public address of your device? 10.x, 172.16.0.0-172.31.255.255, and 192.168.x are all considered "private" address space and are NOT accessible across the internet.

 

[PGB1]

Thanks Ember1205.
I apologize for the delay in replying. Our internet service has been down for a few days. Ironic, isn't it?

I didn't know what to check for when testing the public address, so I went to yougetsignal.com. I entered my public ip address and used their Open Port Check Tool and they gave a list of 20 ports and a button to "Scan All Common Ports". Each returned the result that the ports were closed. I am guessing this was a valid way to test for open ports & all is good.

 

[Ember1205]

Sounds like you're likely in good shape. What matters when it comes to open ports and services is -who- can get to them. Inside of your home has extremely low risk with "no security". Outside of your home has extremely high risk with seemingly full security (no access).

 

[chscag]

@Paul and Ember:

Just a reminder to the both of you that the forums will be closing down for good on December 31st of this year. Please read thru the Sticky in our "Announcement" forum.

 

[PGB1]

Thank You All Again! I very much appreciate the help you all gave me on this question & the knowledge you passed along.

It was very sad to hear of this user group closing. This is absolutely the nicest & most helpful group of people I've met on line. Thanks to the moderators who work so hard to keep this a great place to learn & share!
Paul

 

[chscag]

Thanks for the kind words Paul. Be sure to join us at the new site of our forums when we're up and running. You can take a quick look at it now: www.mac-forums.org (note the "org")

 

[PGB1]

Thank You Chscag for the link to the new site.
It's is fantastic that you & others have taken the time to build a new forum to continue helping people. The sharing of knowledge & expertise from people here is amazing. I am sure many people, myself included (with an exclamation point), appreciate the work and effort you each put into this group.
Enjoy This Day!
Paul

 

[Gnee Chee]

Hi - don't know if you've figured this out yet, but I ran into the same issue ... Phantom device attached to my Arris Router. Like you, I pulled my hair out trying to figure out who or what 198.162.0.252 was, and how they connected to my network.

This is what I've disovered:

- It definitely is an Arris 'device' (based on the MAC address)
- It is used for a mini DLNA/File server if you attach an external drive to the USB port in the back of the modem
- If you login to your router via the administration page, you'll find a "USB" tab. Go there, look around, and you find it all.
- I checked it out - it works as a DLNA server, it works as an FTP server, and according the docs, it can be accessed via "\\192.168.0.252", though that part never worked for me.
- Since port 23 was open on that device - I tried to telnet into it, but was unuccessful
- I don't need an FTP server, and I use Plex as a DLNA server, so I just disabled all of that ... 192.168.0.252 still exists, but now I feel OK with ignoring it ... haha

Hope this helps shed some light on it for you!

EDIT: Forgot to mention that on my system, the "252" device was never there until just recently. So I'm assuming that an recent firmware upgrade enabled that device and turned on the file/ftp/DLNA server stuff.

 

[lclev]

Thanks for the information Gnee Chee. I find it amazing they would create a hook up for a DLNA or FTP server on a Modem. That is so weird to me. It's like someone sat down and said, "Hey, lets provide a feature that most people won't be able to figure out how to use and give it an IP address - just to mess with their heads!" It just strikes me as strange.

What is really interesting is that tech support did not know what was causing the second IP address. Guess that memo didn't get passed down.

Lisa

 

[Slydude]

Member Gnee Chee may be correct about the DLNA server but I'm still thinking that this is tied to the telephony features. These features are documented (albeit poorly when it comes to IP addresses).

 

[PGB1]

Thank You Gnee Chee for your informative reply & details! It explains a lot.
Unfortunately I don't have an Administration page or a page with any reference to USB, although there is a USB port on the device. I suppose the reason I have such limited access is because it's a rental modem from the ISP. My grand plan is to replace it with a purchased modem & router when I get another telephone service set up. (Hopefully soon...)

"Hey, lets provide a feature that most people won't be able to figure out how to use and give it an IP address - just to mess with their heads!" You aren't kidding, Lisa! I've been trying to learn about this after I read Gnee Chee's post & learned the new terms. Perhaps tomorrow I can learn more. Today, my brain refuses to cooperate!

[I]"What is really interesting is that tech support did not know what was causing the second IP address. Guess that memo didn't get passed down."
[/I] I think they missed a lot of memos. For 3 or 4 weeks, I've been stuck going in circles with them trying to fix the problem that Yahoo based e-mail addresses (sbcglobal, ymail, etc) won't receive any mail from anybody's wowway.com (my ISP) addresses. The sender sees them as Sent, but the recipient never gets the mail. Tech Support's Reply? "I don't know" or "Maybe our certificate is invalid" and the famous "We will escalate this to the next level". The help ends there.

Such is life with technology, I guess!

Enjoy Today!
Paul

 

[Gnee Chee]

Unfortunately I don't have an Administration page or a page with any reference to USB, although there is a USB port on the device.

I'm a little bit confused. The Administration page I was referring to can be found at http://192.168.0.1/ (or whatever address your modem/router is at). From there you must login to the router (the username/password are generally "admin" and "password". Once you log in, you should change the password.

Anyway - that is the Admin page I was referring to. Once you're logged in, one of the tabs should be "USB".

I hope that helps

Gnee

 

[lclev]

Gnee - I get what you are saying and also what Paul is saying. It seems not all Arris modems are created equal. I have an Arris modem at work. When I log into it I have very little options and no real administration page. Since I plug my own router into it I really don't care. The router I use is highly programable and I can tweak the settings and firewall to my hearts content. But the Arris has virtually no setting to configure.

Lisa

 

[Gnee Chee]

Okay then ... I guess I made the mistake of assuming that they could all be tweaked equally.

Apologies to all if I just made the situation more confusing

 

[Ember1205]

Gnee - I get what you are saying and also what Paul is saying. It seems not all Arris modems are created equal. I have an Arris modem at work. When I log into it I have very little options and no real administration page. Since I plug my own router into it I really don't care. The router I use is highly programable and I can tweak the settings and firewall to my hearts content. But the Arris has virtually no setting to configure.

Lisa

Lisa, you probably have an actual modem like I do while the other items being discussed seem to be Modem/Router combo's. And, it's the router portion of the software that would offer things like sharing content via DLNA or SAMBA from a USB-attached storage device.

 

[chscag]

Ember is correct. My Arris is a modem - router (actually a special version for FIOS) and it has all the bells and whistles including a slew of menus and settings.

 

[lclev]

You are correct Ember. When I ordered the modem that is all I wanted.

Lisa