I did some nmaping on my Windows PC today, and i’ve discovered an unusual open port:
17500/tcp open db-lsp
Aparently port 17500 tcp is Dropbox LanSync Protocol (db-lsp); used to synchronize file catalogs between Dropbox clients on your local network. This service makes a lot of “noise” , sending broadcast messages very often. It is also a common false-positive for Snort.
If you want to see exactly how many broadcasts, start Wireshark and filter by source port (17500) and destination mac address (ff:ff:ff:ff:ff:ff being the broadcast address).
udp.port == 17500 && eth.dst == ff:ff:ff:ff:ff:ff
It is actually a nice feature implemented by Dropbox – having the ability of syncing file on LAN (when posible) rather than on WAN, reducing a lot of time and bandwidth usage.
Since i’m usualy not on the same LAN with people that i’m sharing Dropbox folders/files, i disabled it. To do so, right-click on the Dropbox icon in the taskbar, click on the gear-wheel in the upper-right corner, choose Preferences, go to the Bandwidth tab and untick the “Enable LAN sync” option.
Now, the port has changed its state to filtered.
Resources