AP mode port 67

[mishaturnbull]

This is a request for information issue

Want to test more in-depth AP mode's port 67/udp.

IANA's serivce name/port registry lists 67/udp as BOOTP, and the associated RFC specifies 67 as the server (with 68 as a client). However, Nmap identified the service as dhcps. IANA doesn't mention it, but Wikipedia mentions that DHCP also uses port 67 (and 68).

nmap -sS -sU -p 67 -T3 -A -vvv --script all 192.168.10.1

This test requires root priviliges.

Is there any chance that this will cause damage/in some way alter the code executing on the camera?
Shouldn't be.

Does this test prelude/follow up on others? If so, what?
Maybe. If the service is bootps, further investigation may yield a method of mapping parts of the filesystem.
If the test is inconclusive, utilizing the DHCP failover protocol (port 647/847) may yield more information.

[mishaturnbull]

Note that in later revisions of RFC951 (for example, RFC1533) mention using DHCP and/or BOOTP over TCP, not UDP (as the port was marked by Nmap).