Network Engineering Stack Exchange is a question and answer site for network engineers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This will be probably a stupid question, but I'm just trying to understand networking. I decided to nmap my router, and found that its only open ports are 23 (telnet) and 80 (http) which is understandable as telnet is for low level configuration, and http is for web interface. I get it. But if those are only open ports, where the router actually receive packets that are going to its default gateway (and internet)? When I nmap its default gateway, I'm getting open 179 (bgp) and 646 (ldp) ports. I don't understand fully what they are specifically for, but it gives my at least some explanation where data from my router is going. But how is my router receving my packets that it's going to route?

share|improve this question

closed as unclear what you're asking by Mike Pennington Jun 28 '14 at 10:48

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

Please elaborate on the exact confusion about how the router receives packets; I am not convinced that we truly understand the question – Mike Pennington Jun 28 '14 at 10:48
@MikePennington The problem is that if I don't know how something works, I cannot ask precise enought question :) . However it seems that people got exactly what I was asking for, and answers are great for someone that want to understand the basic process of router communication. – Łukasz Zaroda Jun 28 '14 at 11:48
Plenty of other people manage to express the technical details of what they understand and where the specific technical gap is. "How is my router receiving packets" is too broad and you're getting answers for different aspects of routers. In light of the helpful answer to the question please reword the question to highlight the specific confusion. – Mike Pennington Jun 28 '14 at 11:54
up vote 3 down vote accepted

Understanding routing requires a fundamental understanding of switching. Whereas routing occurs at network layer (L3) where IP addresses are concerned and switching occurs at the data-link layer (L2) where MAC addresses exist, the source device needing a packet to be routed to a different network (or subnet) will send the packet to its default gateway [IP address]. We won't concern ourselves with how the gateway address gets assigned. The destination address is known to the source usually via DNS (which we won't cover either), so we can focus on the OP's question. A key point to routing is that the source IP and gateway IP are on the same network which uses switching.

The open ports discovered on the router via nmap are used only when sending packets destined to the router (i.e., sent to one of the router's own IP addresses) such as telnet'ing to tcp/23 or when another router speaks BGP to it on tcp/179. The router is mostly handling packets sent through (transit) which are not addressed to it by IP. The ports are transport layer (L4) TCP or UDP ports on top of IP (L3).

To route (IP addresses), you need to switch (via MAC addresses)

So you need the MAC address of the gateway (router). Using the ARP protocol at L2, your source device will craft a packet seeking the MAC address of the gateway IP address. This ARP packet contains the its source IP and MAC address along with the IP address of the gateway with a placeholder for the unknown MAC address. The router recognizes the ARP request matches one of its own IP addresses and sends an ARP reply to the source device with the gateway MAC address. The source is now able to send packets to the distant IP address through the router. See Reason for both a MAC and an IP address.


Source IP: (/24)
Source MAC: 11:11:11:22:22:22
Destination IP:
Destination MAC: We don't ever need this... (left as an exercise for the reader on why)
Gateway IP:
Gateway MAC: 11:11:11:11:11:11
  1. Source IP wants to send packet to destination IP
  2. Source ARPs for MAC address of (gateway).
  3. Router receives ARP and responds with its 11:11:11:11:11:11 MAC.
  4. Source sends Ethernet frame to destination MAC 11:11:11:11:11:11 (router) with destination IP
  5. Router receives ingress Ethernet frame addressed to its MAC.
  6. Router looks up destination IP in its route table to determine which egress interface to use.
  7. Router sends packet to next hop after rewriting source MAC with its own MAC of the egress interface and the destination MAC of the next hop.

Another key point here is that the router also needs to do L2 switching and ARP for the MAC address of the next hop to move the packet along, and this routing/switching one-two combo continues along the hops until the destination IP is reached.

share|improve this answer

Remember that ports are at layer 4, and a router operates at layer 3. It receives an IP packet, looks at the destination address, and checks its routing table to determine which interface to forward the packet out of. It never examines the layer 4 data. So in that sense, ports and upper layer information are just "data."

share|improve this answer
Where "destination" not equal to "self" (any locally configured address) – Ricky Beam Jun 28 '14 at 0:10
It does, however, pay attention to ports when examining packets for ACL's. – Davidw Jun 28 '14 at 2:21

packets that are sent to the router to be forwarded to a final destination are sent to the router using the router's mac-address, but have the IP address of the destination host in the IP header. Therefore, the router receives the packet fully aware that these packets are forwarding only and don't intend to address the router as a host itself.

share|improve this answer

Remember that nmap checking for open ports will not tell you what packets the router receives, but only what packets it receives and reacts to by sending you a positive reply.

If you are connected to the router over plain ethernet, the hardware will effectively receive all packets that transit on that ethernet trunk (as long as it's connected with a plain hub), will forward to the logic (probably done in software for cheap routers) only those that have the router NIC mac address or a broadcast address in the ethernet header. The logic will in turn analyze those packets and decide how to handle them. If a packet has the router itself as a destination in the IP headers, the an higher level software layer will decide how to handle it. If it decides to positively respond to you, then you'll see an open port in the nmap output.

share|improve this answer

The router 'recieves' everything you send it, unless there's a fault in the cable. However, the data may be discarded at some point. First it looks at the target. If the target is for someone else (someone else on the local network, or an external ip address) the it does its job of routing the packet to that target. However, if the target is the router itself, then the port is compared against a list of which ports are allowed/opened. For nmap to mark a port as 'open', it sends a packet to the router, targeted for the router, asking nicely for it to open a connection on port n. If nmap gets positive reply, and connects succesfully then it marks that port as open. However, if nmap gets a negative response, or no response at all, it marks that port as closed.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.