Printable View
Hello
I have been testing the firewall on my 2'nd pc and i am now trying a port scan with a fixed source port of 80.
Everytime i check the fwall logs it is shown as coming from high numbered ports 1500+
The pc i am testing it from is connected to a router which is using Nat, Will this affect my results.
Thx
while a web server listens for incomming connections on port 80 (standard) your out going requests start at the first available port over 1024 and go in succession.
so in theory if your first request is to a webserver:
local ip 127.0.0.1 port 1025 > remote ip 90.90.90.90 port 80
and your next is for ftp:
local ip 127.0.0.1 port 1026 > remote ip 90.90.90.90 port 21
of course there is more traffic thats normally involved so its not really this simple but i hope this helps helps
As Tedob1 has mentioned, normal connections will begin on port 1025 and above. The fact that you are seeing source ports in the 1500 range is evidence that you are not source port scanning properly (as 80 is obviously the destination port). What program are you using to perform these scans?Quote:
I have been testing the firewall on my 2'nd pc and i am now trying a port scan with a fixed source port of 80
duh! cant believe i missed that it was only THE FIRST LINE. sorry dude!
I have tried Nmapnt with the following options -sS -vv -e 1 -p0 -g 80 xx.xx.xx.xx
I have tried with the -g switch in various places, I have also tried it with Fscan using the -i switch.
I always get the same results, Source port of 1500+
Perhaps these tools need to make use of raw sockets to create spoofed packets and your OS does not support that?
I guess this would be a good time to ask what OS you are using.
Both machines are running 2k
Have you installed winpcap?Quote:
Originally posted here by norman221
Hello
I have been testing the firewall on my 2'nd pc and i am now trying a port scan with a fixed source port of 80.
Everytime i check the fwall logs it is shown as coming from high numbered ports 1500+
The pc i am testing it from is connected to a router which is using Nat, Will this affect my results.
Thx
Also, what firewall are you running against? and what exactly is the setup? sounds like you have a router handling NAT for the target box and a local firewall installed, is that correct?