source port scanning through router
Results 1 to 10 of 10

Thread: source port scanning through router

  1. #1
    Junior Member
    Join Date
    Sep 2001
    Posts
    5

    source port scanning through router

    Hello

    I have been testing the firewall on my 2'nd pc and i am now trying a port scan with a fixed source port of 80.

    Everytime i check the fwall logs it is shown as coming from high numbered ports 1500+

    The pc i am testing it from is connected to a router which is using Nat, Will this affect my results.

    Thx

  2. #2
    Senior Member
    Join Date
    Nov 2001
    Posts
    4,786
    while a web server listens for incomming connections on port 80 (standard) your out going requests start at the first available port over 1024 and go in succession.

    so in theory if your first request is to a webserver:

    local ip 127.0.0.1 port 1025 > remote ip 90.90.90.90 port 80

    and your next is for ftp:

    local ip 127.0.0.1 port 1026 > remote ip 90.90.90.90 port 21

    of course there is more traffic thats normally involved so its not really this simple but i hope this helps helps
    Bukhari:V3B48N826 “The Prophet said, ‘Isn’t the witness of a woman equal to half of that of a man?’ The women said, ‘Yes.’ He said, ‘This is because of the deficiency of a woman’s mind.’”

  3. #3
    Master-Jedi-Pimps0r & Moderator thehorse13's Avatar
    Join Date
    Dec 2002
    Location
    Washington D.C. area
    Posts
    2,884
    I have been testing the firewall on my 2'nd pc and i am now trying a port scan with a fixed source port of 80
    As Tedob1 has mentioned, normal connections will begin on port 1025 and above. The fact that you are seeing source ports in the 1500 range is evidence that you are not source port scanning properly (as 80 is obviously the destination port). What program are you using to perform these scans?
    Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
    Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden

  4. #4
    Senior Member
    Join Date
    Nov 2001
    Posts
    4,786
    duh! cant believe i missed that it was only THE FIRST LINE. sorry dude!
    Bukhari:V3B48N826 “The Prophet said, ‘Isn’t the witness of a woman equal to half of that of a man?’ The women said, ‘Yes.’ He said, ‘This is because of the deficiency of a woman’s mind.’”

  5. #5
    Junior Member
    Join Date
    Sep 2001
    Posts
    5
    I have tried Nmapnt with the following options -sS -vv -e 1 -p0 -g 80 xx.xx.xx.xx
    I have tried with the -g switch in various places, I have also tried it with Fscan using the -i switch.

    I always get the same results, Source port of 1500+

  6. #6
    Member
    Join Date
    Dec 2002
    Posts
    63
    Perhaps these tools need to make use of raw sockets to create spoofed packets and your OS does not support that?
    $pak = me;

  7. #7
    Master-Jedi-Pimps0r & Moderator thehorse13's Avatar
    Join Date
    Dec 2002
    Location
    Washington D.C. area
    Posts
    2,884
    I guess this would be a good time to ask what OS you are using.
    Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
    Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden

  8. #8
    Junior Member
    Join Date
    Sep 2001
    Posts
    5
    Both machines are running 2k

  9. #9
    Member
    Join Date
    May 2002
    Posts
    68

    Re: source port scanning through router

    Originally posted here by norman221
    Hello

    I have been testing the firewall on my 2'nd pc and i am now trying a port scan with a fixed source port of 80.

    Everytime i check the fwall logs it is shown as coming from high numbered ports 1500+

    The pc i am testing it from is connected to a router which is using Nat, Will this affect my results.

    Thx
    Have you installed winpcap?
    [gloworange]
    find /home/$newbie -name *? | www.google.com 2>/dev/null
    [/gloworange]

  10. #10
    Senior Member
    Join Date
    Oct 2002
    Posts
    314
    Also, what firewall are you running against? and what exactly is the setup? sounds like you have a router handling NAT for the target box and a local firewall installed, is that correct?
    Quis custodiet ipsos custodes

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •