Port scan results: unexpected open port on my wrt160nl

Question

I ran NMap on the internet side of my wrt160nl, and was surprised to find port 55637 open. I have two ports forwarded and this open port is neither of those. I updated my router firmware and the open port moved to 63932, then after a reboot the open port moved back to 55637. I connected to that port with telnet, and it slammed shut as soon as I tried typing any ASCII key. I can see this open port from both sides of my router. A couple of questions: Could this be malware running on the router? Can anyone recommend any tools that might be able to determine what service is running on that port? Thanks! HeXwAvE

Answer 1

Nope didn't fix fix it. There still seems to be an internet facing port open on my router.
1. I reset the router.
2. Upgraded the firmware.
3. Ran http://ping.eu/port-chk/
The only change is that no port 63932, rather than 55637 is open. I suspect http://ping.eu/port-chk/ only checks well-know ports below 2200. I re-ran nmap, this time using -sV, and it reports 63932 as "tcpwrapperd", Insecure.org says:
"tcpwrapped" refers to tcpwrapper, a host-based network access control program on Unix and Linux. When Nmap labels something tcpwrapped, it means that the behavior of the port is consistent with one that is protected by tcpwrapper. Specifically, it means that a full TCP handshake was completed, but the remote host closed the connection without receiving any data. It is important to note that tcpwrapper protects programs, not ports.
This means that a valid (not false-positive) tcpwrapped response indicates a real network service is available, but you are not on the list of hosts allowed to talk with it. When such a large number of ports are shown as tcpwrapped, it is unlikely that they represent real services, so the behavior probably means something else.
Which hosts? It looks like a back door or security vulnerabilty from where I'm standing. Scary.