Baslinux mailing list

[Lee Forrest <lforrestster AT gmail.com>]

On Sun, Jan 28, 2007 at 11:26:06PM +0200, Karolis Lyvens wrote:
> On Sun, Jan 28, 2007 at 12:14:34PM +0000, Lee Forrest wrote:
> -snip-
> > That's garbage. Makes it look like I'm running an incredibly busy
> > server with an excellent firewall. I don't have most of those
> > apps on this box. In fact, I've never even _heard_ of most of
> > them. And I'm not running any network daemons/(super)servers. I
> > have an FTP server, but it's not up.
> 
> It might have been you. "Filtered" ports mean this:
> 
> It (scanner) sent a packet to this port, but got back nothing. Meaning
> that packets were simply dropped on floor (not replied to).

> In contrast to this, "closed" port means that it is unused
> and, when trying to access this port, ICMP "REJECT" packet was
> received (sent to scanner from that host). Opened port means
> that a normal reply was gotten from that port.

I ran it again, using tcpdump, and checked the log. They didn't
send any ICMP or UDP packets, only TCP.

Which my box responded to in kind: Going to have to do something
about that. I've installed ipchains from SW4.0 and rebuilt my
2.4.31 kernel to include the NETFILTER code (it was IP_FILTER
when 4.0 was current), but don't know whether ipchains and
netfilter are compatible yet.

> On nmap, if you use "-P0", ie, omit ping test, you'll get ALL
> ports "filtered", although the host isn't even up.

Doesn't look like they were pinging  me. That's ICMP, is it not?

> These "filtered" ports tend to confuse this mailing list :)

Worked with me! :-)

Unless, of course, you are wrong, and they were scanning simple.net AKA
1dial.com AKA IPSWITCH INC.

> So, in short, "filtered" port means that the port is unused and
> no reply was gotten from it
>
> > I wouldn't use this site. It could get you in trouble. They
> > could have nmap configured to give _your_ IP as the origin of
> > the probe. Such capabilities are strongly-implied in the man
> > page.
>
> That site only allows your IP to be scanned. Excerpt from FAQ:
>
> ----- 4. How about a port scanner?
>
> A port scanner is a great security tool. It is one of the first
> things you would want to do after a new bastion host comes on
> line. The problems are several. Port scanning can be used by
> those with bad intentions to locate vulnerable systems. Port
> scanning will often annoy system administrators by setting
> off intrusion alarms, triggering IDS systems, causing "paging
> in the middle of the night" automatic IP blocking, snmp trap
> alarms and lot of other issues. If I can devise a way to
> overcome ( or at least greatly diminish ) these issues... a
> port scanner may well be added to the existing tools.
>
> On 5 July 2003 Added port scanner. It will only scan the
> connected/requesting host. If no security issues develope it
> will stay and more features may be added as time allows. -----
>
> Karolis

> That site only allows your IP to be scanned. Excerpt from FAQ:

That's what they _say_. Anyone can _say_ anything. I don't trust
the security freaks. They see crackers under every inode. And
like the get-in-your-face spam haters, they often turn out to be
the very thing they claim to be fighting.

Lee

-- 
BasicLinux: Small is Beautiful
http://www.basiclinux.com.ru