Printable View
Hey-
So I decided to do some scans on my box w/o my firewall. So far I have passed symantec, but not "shields up!". I couldn't pass shields up because I responded to ping, and all my ports were closed, not "stealth", which they are with my firewall on. I wondering how I can stealth or disable ping, and stealth the rest of the ports (win xp pro), W/O my firewall on. Is this possible? I think this will help enlighten me as to how a firewall works in the first place...
Thanks-
What is the URL to the "sheilds up" test, I passed nortons online test as well, except my ping. How do you disable the ping so hackers cant ping your computer?? With ping disabled will I still be able to ping other people and websites??
I agree with h3r3tic, having no firewall and still having all those ports atleast closed is pretty damn good.
I don't think you can do it without a firewall. Or at least you'd have to have something to put over the port to make it be stealthed. I don't really think there's a problem with a port being closed. You should be happy.
Under WinXP Pro, which is what I have, open up your local area connection properties, then choose the advanced tab. Check the firewall, then select settings at the bottom. Ping is nothing more than ICMP, so make sure that all ICMP is set to 'Not Allow'. Then save and exit.
WinXP Home edition has the firewall as well, I knew about the firewall that it has, but Im not im not suppse to use it because I have wireless network and it might interfere. Besides the router that comes with the wireless network already comes with a firewall and it seems to work alright seeing as how the norton test showed that I have all the most common attacked ports either closed or invisible. But could you explain the ICMP thing to me?
Ping is a TCP/IP utility used to test whether another host is reachable. An ICMP request is sent to the host, who responds with another reply if it is reachable. The request times out if the host is not reachable, or the target has been programmed to drop ICMP requests and packets. Most 3rd. party firewalls include some form of ICMP handling, but Windows has only a few options, described above. ICMP is commonly run on port (7) which is 'ECHO' port, and is part of TCP/IP services. My two Linksys routers are configured to drop, which is different that responding with a no, to ICMP requests. Saying 'no' still lets a port scanner or cracker know you are there. By 'dropping' the request, the network doesn't even know you are there..ie: stealthed. GRC does a wonderful job of picking this up in a vulnerable system. Another thing GRC finds as a vulnerability when running routers is port 113; the IDENT port. Anyone running a router should port forward 113 to something like: 192.168.1.255, which will result in stealthing 113 also.
I use a wireless network, so I suppose I need to keep ping allowed for this right? or would it not matter if I say no to icmp?
If it's your own internal wireless network (home) then you don't need ICMP at all. If you belong to a wireless network..ie: laptop with wireless card, etc.. then you need ICMP to let the host know you exist.
I think you guys are mistaken as to what he is asking, I believe he wants to know if there is a way to stealth the ports without the firewall...yet you tell him to enable the firewall. Anyway, The only thing I could think of off hand would be to stick a router in there but that is just using the NAT to kinda block it, I am not sure if you consider that cheating since that is close to a basic firewall. upon a quick google search I couldnt find anything other than references on how to configure your firewall to make the ports stealth. Hope I didnt misunderstand :)
GR, Yes I am on a wireless network with a pc card on my laptop, but the laptop is at home and so is my router. So do I need icmp for this kind of setup? Im not using a host, were you thinking like the wireless internet from like a satellite or something? Or maybe it is the host, damn im so confused, I tell ya, when it comes to networking im almost a complete noob, mainly cause I havent had the interest in learning about networking just yet.
No, I thought of several things, like maybe stealing someone elses connection (like your neighbors), or maybe a satellite. But if it's your own home network then you don't need ICMP. As far as above and me telling the other member to turn his firewall on, sorry. I was only thinking of 3rd. party firewalls you were concerned about. If you want absolutely no firewall but want to block ping, then you are out of luck as far as I know. I've been in the business for some time and the only way to block/drop ICMP is to have something (firewall, IDS, iptable, ipchain) in the way between your box and the connection. A router with NAT, still a firewall in my eyes. Hell, even your own ISP is running some form of a firewall for you to some extent. Regardless, to block ICMP without some form of service, hardware, or software, is unknown to me.
One last thing. I understand the curiosity of wanting to test without a firewall, but if you already have one in place, and it's doing its job, then why remove it from the equation? I've tested with GRC and many other sites and specialists to find weaknesses on my box, but never without at least one firewall in place. Guess it's just me being paranoid. I hide behind two Linksys routers and three software firewalls. But it's not just my computer I protect, it's me, myself, and my information. All worth protecting.
Yes... W/O a firewall, along the same lines as disabling other uneeded services.
http://www.antionline.com/showthread...hreadid=256289
I am messing around with the no firewall theory catch brought up... occams razor if you will. Pooh brought up that you can't be fully protected...
So I am finally getting off my ass and trying out catch's POV. But there isn't too much documentation on this type of technique, so I am just scanning and removing whatever I find. I haven't gotten a chance to move on to UDP yet... I'm kinda working in the darkQuote:
We must keep in mind that Windows itself runs a good 10 - 20 UDP ports at all times for it's internal use and DLL calls (in some distros, DCOM), making an unpacket filtered computer a prime target for UDP exploitation and DDoSes.
Sorry about bringing up the firewall thread :p
Soda:
Have you looked into tightening everything down via policy too?
For some good examples... look at the NSAs.
http://security.ouhsc.edu/documents_nsa_guidelines.asp
Download archive
Some of it is a bit overkill...
The first time I used it... I didn't modify any of it and I could barely do anything on my system.
I now know how to work around and what to apply...
So, make sure you read the guides... or you'll be stuck like I was. (I didn't read at first... just applied).
BTW: Shields UP is here: https://grc.com/x/ne.dll?bh0bkyd2 (for The Duck)
You would not need icmp in that case.
How well can you trust Shield's UP or Syamntec? This much:
An error has occurred
Symantec Security Check is not compatible with your computer settings because:
Error 001
Security Scan and Virus Detection do not work with your operating system. To run Security Scan and Virus Detection, you must be using Windows 98/ME, NT 4.0 Workstation/2000 Pro/XP, or Mac OS 8.1 or higher.
I guess Linux must be out of the reach of security vulnerabilities.... ;-)
symantec:
It has nothing to do with trust... it has to do with following directionsQuote:
Requires Microsoft Internet Explorer 5.0 or higher or the latest version of AOL with ActiveX and scripting enabled.
You can only use these things as a guide.. If a malware is only listening on a port when it feels like it.. then it most likley not show on any of these tests..Quote:
How well can you trust Shield's UP or Syamntec?
In my work I have a Digital Meter that is accurate to 0.01% if the voltage is 5.0012Vdc then that is what it is.. But if I am measuring at the incorrect location.. then the result will be wrong.. or if the meter is set to the wrong range (ie AC instead of DC).. the readings are meaningless.. Is it the meters fault I am getting the incorrect results?
phishphreek80
Thanks for reminding me of that resource.. To lazy to finish reading..
Cheers guy's
Ahem.... There's a huge hole in this conversation....
[RANT]
ICMP IS NOT RUN ON PORT 7!!!!! ICMP is it's own protocol that doesn't use ports like TCP/IP.....
ECHO is a TCP/IP service usually only implemented on *nix boxes that allows you to echo back to you the data you send to it for troubleshooting issues.
ICMP is often reported by firewall logs as port zero..... that is also incorrect but it's their way of doing it.
ICMP has several "message types", echo request, echo reply, destination unreachable etc.... These are ICMP "types"... each type has a number, type 8, type 10 etc.... they have nothing to do with a port seven ECHO....
These types are not correolated to ports.... they are entirely different..... It's important to know that little detail and I'm a little surprised that no-one else noticed/mentioned that in the answers before me...... The protocols are separated by their function, intent and application.
Please learn the _basics_ before "spouting off". You make yourselves look ignorant and you degrade the forum as a whole....
[/RANT]
Hey Hey,
While we're on the subject of problems with this thread, the whole comment about ICMP mattering if you are wireless on your own network or someone elses (because they won't see the host or some BS like that)... is all a bunch of bullshit. Oddly enough both comments came from the same person, I think that person should keep their mouth shut and go read something, other than incorrect information. I know I said I'd stop flaming people, but two pieces of incorrect information in the same thread, seriously.. there's a problem with that. Making a mistake is one thing, but blatent misinformation is just wrong, wrong wrong.
Also I just want to point out the word usually in TS's post.... Because if you really wanted you could run an Echo Server in Windows. Infact there's a python script floating around AO with an echo server I wrote.
Anyways, if you don't want to use a firewall, then IPSec is a good thing to look into (Run gpedit.msc it's under security) and also the filtering on the adapters (connection properties --> tcp/ip properties --> advanced --> options) You can enable TCP, UDP and IP filtering. The first two are port based and the last is protocol based. If you aren't doing anything funky and only need TCP and UDP, then just permit those protocols, it'll filter everything else. If you need to add ARP then add it, or add everything except ICMP, or IGMP or whichever else you want it to filter. If you are unsure of the numbers to enter for the IP Protocol, a great resource is located @ http://www.networksorcery.com/enp/topic/ipsuite.htm. You can click on the protocols and find their protocol numbers.. ie. TCP = Protocol 6.
Anyways beyond that, disable NetBIOS over TCP if you don't need it, and then just search google for ports you find open.
I just reread grim_reaper1's post. I suggest you ignore everything he said. I understand that I flamed him earlier, but he's got some issues. Telling you to forward your ident port to .255? He's assuming a subnet mask of 255.255.255.0 which means x.x.x.255 is going to be your broadcast address. Every Device on your network will end up recieving that request, or it'll get dropped, depending on your routers settings, However something tells me your average home router would not drop broadcasts.. it doesn't seem like they're that intelligent. However another thing, port 113 is IDENT (about the only correct thing he's stated). If you use IRC your irc client is going to need port 113 to respond to ident requests. If you are using mirc you should check that box that says only enable ident when connecting. that way port 113 will only be open when you are connecting to IRC and closed the rest of the time. For minor networks you may not need ident, but for the larger networks IDENT is generally required.
As for a last thing, there's another thread, not sure where it is.. i'm sick and the room is spinning, however it has discussed this subject. It doesn't really matter if your computer responds to pings.... big flipping deal. They aren't going to break into your computer because your computer responds. It's just like stealthing your ports, who cares if they are stealthed... it's not the end of the world. So they know you have a system online, in the grand scheme of things, it affects nothing, as long as you have secured your system.....
I'm leaving because i'm gonna go pass out.
Peace,
HT
PS. I hope this makes sense.
Thanks a lot everyone.
I used Fport by foundstone to help close the ports, its a lot quicker than googling the ports, because it connects the service with the port.. Theres a lot of cool stuff in the group polices (gpedit.msc) like changing the IE icons...:p
HT.. I'm in group policy, computer config>win settings>security settings, but I dont see connection properties. I attatched a screen.
GR... how many firewalls ya got there?
Hey Hey,Quote:
Originally posted here by Soda_Popinsky
Thanks a lot everyone.
I used Fport by foundstone to help close the ports, its a lot quicker than googling the ports, because it connects the service with the port.. Theres a lot of cool stuff in the group polices (gpedit.msc) like changing the IE icons...:p
HT.. I'm in group policy, computer config>win settings>security settings, but I dont see connection properties. I attatched a screen.
GR... how many firewalls ya got there?
Soda: Connection Properties are seperate... I guess i didnt' seperate them all that well. Look under View Network Connections --> Properties for your specific connection --> TCP/IP --> Advanced --> Options
As far as using fport, it's a wonderful tool. Occasionally you'll notice that certain ports will be linked to svchost. You always have multiple SVChosts running, but luckily fport gives you the PID, however... what is that magical SVC host running. What you can do to find out is at your command prompt type tasklist /svc. You'll get a breakdown of which services (from Administrative Tools --> Services) are running under each SVCHost. This will give you an idea of which services you can turn off to close certain ports.
Peace,
HT
First, let me say that you are in fact wrong. ICMP is run on port 7 (echo) port. For those that do want to read, it's explained in perfect detail in the book " Complete Security" by Sybex, under chapter 11 "Understanding Firewalls", page 381, written by Matthew Strebe and Charles Perkins. Look it up. By the way, have you written a book on the subject recently? Oh, well then, shall we move on. up.
Now, on to point two. Flame me as much as you can *******, I love to hear babies whine. I told them to forward port 113 (Ident) to their routers IP address (not subnet) of (example): 192.168.1.255. This also is explained in perfect detail from Steve Gibsons's website GRC. But I guess the know-it-alls of this world (or maybe just this forum) only want to flame due to small penis syndrome. You can go on and on about the little scripts you write on python or what have you, who cares. Big deal. Who hasn't written a script lately?
My computer world revolves around security, no matter how overboard and overkill it is, it's for a reason. But I understand forums are to help ppl, and occassionaly you run in to someone who just loves to act like a self indulgent, overbearing, know-it-all jack off.
OK, now you may feel free to run off to your buddies and have me banned for speaking my mind.
Grim:
Do me a favor..... Don't compound your problems, (read ignorance), by coming back and trying to slag people down.....
Read the ICMP RFC
Please note several things.
1.Funny..... No mention of TCP.....Quote:
ICMP, uses the basic support of IP as if it were a higher level protocol, however, ICMP is actually an integral part of IP, and must be implemented by every IP module.
2.Note please that there is NO room for flags, window size and most importantly source and destination port..... Because they are functions of TCP not IP.Quote:
ICMP messages are sent using the basic IP header. The first octet of the data portion of the datagram is a ICMP type field; the value of this field determines the format of the remaining data. Any field labeled "unused" is reserved for later extensions and must be zero when sent".
3.Then try reading the TCP RFCQuote:
The Internet Protocol is not designed to be absolutely reliable.
1.Apples and Oranges.Quote:
The TCP must recover from data that is damaged, lost, duplicated, or delivered out of order by the internet communication system.
2.Hmmm.... I see ports.....Quote:
TCPs are free to associate ports with processes however they choose. However, several basic concepts are necessary in any implementation. There must be well-known sockets which the TCP associates only with the "appropriate" processes by some means. We envision that processes may "own" ports
Just for giggles.... try reading the IP RFC
Hmmm.... ICMP is structured with a standard IP header and and ICMP type and Code.... The IP header contains TOS, TTL, Options and Header Checksum........Quote:
The internet protocol uses four key mechanisms in providing its service: Type of Service, Time to Live, Options, and Header Checksum.
Show me how and where it is communicating using TCP ports when there is no room in the packet structure!!!!!
You stated in one of your postsyet you don't have the basics down yet.... The RFC's are there for a reason..... For you to read and learn from. The RFC's are the "bible"..... Just because others have it wrong does not mean that everything changes to suit their errata.Quote:
I've been in the business for some time
On to your second Faux pas...... You have 0-255 IP addresses to chose from, (a total of 256). Only 254 are useable, (1-254), because 0 and 255 are used for broadcasts etc. (ever wondered why an ISP gives you 16 IP addresses and you only get to use 14.... there's your reason....) So you had a 2/256 or a 1/128th chance of picking a reasonable IP address for the router and you picked a bad one..... 192.168.1.255 is the broadcast address of the subnet 192.168.1.0/24. Whether the "mistake was due to ignorance or simply not thinking it was a bad example to use and HT was perfectly justified in picking you up on it.
Isn't it funny how your response fits you perfectly into that category....... :rolleyes:Quote:
and occassionaly you run in to someone who just loves to act like a self indulgent, overbearing, know-it-all jack off.
GrimReaper:
Sorry, but you are just wrong. You are confusing the type field of the IP header in the ICMP packet with a port. ICMP doesn't need (nor is it interested in) ports; it just checks the connectivity involved. It uses IP but is not the same as TCP or UDP. Since you like to quote sources, why don't you check out the rfc at http://www.faqs.org/rfcs/rfc792.html or check out the paragraph on ICMP ping sweeps at nmap .
Additionally, what is the fascination with people's penises? Why do you (and others, I know from experience) feel the need to include such crass statements when responding to posts? Grow up.
Also, learn what a broadcast, multicast, and unicast address is. Then check back in.
Lastly, only someone who truly didn't understand security would brag about "hiding" behind two routers and 3 firewalls (as you did earlier in the thread) You are doing just that, hiding. If you actually knew how to configure one firewall properly (or even just your box and no firewall, as was the intention of the thread starter), then you wouldn't need to waste resources on 3 firewalls.
EDIT: heh, didn't mean to echo you, Tiger....I waited to long to finish my response...dang multitasking... ;)
The short answer: there is no way to succeed a ShieldsUP test without a firewall. The test is invalid, worthless if you want to test ACTUAL security IMO, and flawed in more than one way. Having your ports report closed instead of "stealthed" is not a security risk.
csch:
But since the inception of the stealth fighter and bomber the mere word "stealth" has take on such a "sexy" inference that everyone thinks it's just plain "kewl" to be "stealthed", it makes those who obviously really don't know or think about the technical details feel like the little ninja's they always wanted to be.Quote:
Having your ports report closed instead of "stealthed" is not a security risk.
GRC and his Shields up was fine when he started, (probably should have stuck with spin-rite - but that's a different issue), it told people that they were _wide_ open. Then I think he got a little carried away. Unfortunately, in sensationalizing his "products" and doing it in a highly technical sounding way a lot of people put way too much stead in the things he says. This is exacerbated by his attacks on major players like Black Ice.... It makes people think he really does have something important to say.
It doesn't surprise me that Grim quotes him as a source - he has demonstrated that his technical knowledge is right there in the target zone GRC aims at - those with insufficient technical knowledge to know the difference between hype and fact.... Those with just enough knowledge to be actually a _real_ danger........
Hrmm... Must say this is an interesting discussion. A couple of "opinions" (whether you want 'em or not)..
Books are sometimes wrong. Just because the book says so, doesn't make it so. That's reality and certainly we shouldn't depend on one to be our main source for security (well, except for my fav security author -- Stephen Northcutt). That said, the association of ICMP to TCP/Port 7 is a common mistake and I'm suspicious that's a result of a generalization that the echo port returns whatever data it's sent (thus echoing it). This link might help. For those that might feel bad about this, don't. Even I've done that mistake (*insert Homer's "D'oh" in here*).
When testing a machine without a firewall, it might be better to use a variety of tools rather than depend on something like GRC or Symantec. Single dependency on one tool to be the answer to determining how successfully or unsuccessful you are at locking a machine down is akin to putting all your eggs into one basket. Nothing stops you from scanning yourself using additional tools like nmap, nessus, retina and even a simple command like netstat (which can show which ports are listening so you can determine which services might be active).
Another point... I've been viewing my firewall as a crutch almost. Like medicine... it hides anything that may be wrong. So I turned it off, and found a lot of unneccsary problems, like a print driver opening a port (a old printer I no longer own). Like I said before, Fport is great for doing this.
So far, nessus and nmap have failed to work under xp (with the correct winpcap). I got to get to class, maybe I can post the errors later.
Soda, its under IP security policies. (A right click on it should allow you to create/edit policies)
Its not the most intuitive interface but its more than capable of doing everything you need.
-Maestr0
That's something I've heard a lot. Perhaps a look at Retina (use the trial for the 14 days) or other Windows specific vulnerability scanners. Or.. if you have a spare box fire it up in Linux. WebAttack (now called SnapFiles) has a nice selection of Freeware scanners.Quote:
So far, nessus and nmap have failed to work under xp (with the correct winpcap). I got to get to class, maybe I can post the errors later.
And aren't you supposed to use Newt for Windows in regards to Nessus?
This sounds more like what HT was talking about it... and Maestro's comment brought up something similar, but not what HT was speaking of...
I think HT mightof been confused, I was able to get to his screen not through the group policys, but through the control panel on my network connection(right click properties).
Now that I think of it, I might of been confused as to where it was. I attached a screenie.
MsM...
I used newt, and it doesn't work. I do have access to a linux box with all of these tools working... but I don't like it when stuff doesn't work on windows (easier to get stuff done on one box). All of those tools practically come by default with most distros, I wish windows would do the same. It all came with slack, by the way.
As for stealth vs. closed:
That guy offers no credibility behind quote, but I think he's right.Quote:
The problem with this is simple -- it is not possible to attack closed ports, and as a result it is unnecessary to hide them from scanners. This simple piece of information is the key to defending vs. mass-scanners - don't. They can't hurt you. And as far as directed attacks go, do you think that having your ports stealthed vs. closed is going to discourage a talented and determined attacker? Do you honestly think that they are going to say to themselves, "Well damn, the guy stealthed his ports...if he had only left them closed I would have tore him up..."
http://www.dslreports.com/forum/rema...2338~mode=flat
I'm starting to believe that a program that offers realtime monitoring of your ports, (like what fport does, but in realtime) would be more effective (and less bloated) than a firewall, maybe. An ideal program of this nature would be a icon in the system tray that I can click on, and see whats going on with my ports, and it would monitor the software (set access rules) trying to access the internet. Anything like this?
Actually I think what I just said is what a firewall basically is....
I apologize for being a post whore today....
Retina absolutley rules. Thanks MsM, I'm in love... It detected all kinds of flaws with my box.. I attached a screenie. again.
The problem is... it's telling me I am all up to date on windows update, but this is telling me I am missing patches...
:confused:
edit correction-
those are patches that are already in place, the red arrows.. at least i think so.
Keep in mind that sometimes patches != hotfixes. Do searches in the Knowledge Base to see if there is other files to install. Also, use some other scanners to double check what Retina found. While eEye is good no one is perfect.
Hey Hey,
Soda: I was tired at the time and my thoughts ran, that's why i posted the second timeQuote:
Originally posted here by Soda_Popinsky
[B]This sounds more like what HT was talking about it... and Maestro's comment brought up something similar, but not what HT was speaking of...
I think HT mightof been confused, I was able to get to his screen not through the group policys, but through the control panel on my network connection(right click properties).
Now that I think of it, I might of been confused as to where it was. I attached a screenie.
/B]
You can do TCP or UDP port-based filtering of IP protocol-based filtering from that screen.Quote:
Soda: Connection Properties are seperate... I guess i didnt' seperate them all that well. Look under View Network Connections --> Properties for your specific connection --> TCP/IP --> Advanced --> Option
The other option is IPSec which is found under group policy (gpedit.msc) in the security section. I just ran them together quickly, hoping that you'd pick out the seperation.
As far as patches go, you should remember that MS Office patches have to be installed seperately, they aren't included in the Windows Update site, you have to visit the MS Office site and run the online update that's located there.
Another app that you may wish to check out is Languard Network Security Scanner, It's not necessarily as advanced as retina, but it'll give you a very decent scan. -- http://www.gfi.com/lannetscan/
Peace,
HT
http://www.antionline.com/showthread...939#post734939Quote:
"I'm starting to believe that a program that offers realtime monitoring of your ports, (like what fport does, but in realtime)"
-Maestr0
Quote:
I'm starting to believe that a program that offers realtime monitoring of your ports, (like what fport does, but in realtime) would be more effective (and less bloated) than a firewall, maybe. An ideal program of this nature would be a icon in the system tray that I can click on, and see whats going on with my ports, and it would monitor the software (set access rules) trying to access the internet. Anything like this?
I had missed this until I saw Maestr0's post. I would highly recommend that you check out TCPView from Sysinternals. It does just about everything you want. Monitors connections in "real time" (there might be a few second delay for refreshes). It'll map it to an application, and allow you to kill any established connections...
You can find it @ http://www.sysinternals.com/ntw2k/source/tcpview.shtml
There's another program but it's name has slipped my mind, I believe it's Telsa or something similar to that, if i find it I'll post a link.
[Edit]
I remembered the name, it's Tesseract. You can find it @ http://www.snapfiles.com/get/tesseract.html
PS. AO needs a strike-out tag, then we could strikeout old comments and post the new ones. People could follow the line of thought (old stuff would be kept for continuity).. i'm going to wonder over to the suggestions forum.
[/Edit]
Peace,
HT
Again, I'm very sorry for bringing up a controversial thread, but it's so interesting to me I feel I have to (also sorry for knockin this thread back to the top of the main page).
http://www.antionline.com/showthread...289#post733045
nmap my.ip.my.ip -sUQuote:
Don't believe me? Turn on your windows machine and turn off your firewall. Now ask a friend to run a complete TCP and UDP port scan on you. Notice the stack of UDP go further and further down the list. How could this happen, even though you are not running the services?
Because windows REQUIRES THEM, but only needs them internally. Since they are still kept open to the public, they still cause you a threat.
Then fport of those ports:Quote:
Starting nmap 3.48 ( http://www.insecure.org/nmap/ ) at 2004-04-23 13:06 CDT
Interesting ports on xxxxxxxxxx (xxx.xxx.xxx.xxx):
(The 1476 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
123/udp open ntp
1025/udp open blackjack
Nmap run completed -- 1 IP address (1 host up) scanned in 2.957 seconds
Documentation has show that stopping ccApp would cause my autoprotection to cease in NIS and NAV- so I'm not sure about closing that.Quote:
FPort v2.0 - TCP/IP Process to Port Mapper
Copyright 2000 by Foundstone, Inc.
http://www.foundstone.com
Pid Process Port Proto Path
4 System -> 445 TCP
332 ccApp -> 1027 TCP C:\Program Files\Common Files\Symantec Shared\ccApp.exe
0 System -> 123 UDP
4 System -> 445 UDP
332 ccApp -> 1025 UDP C:\Program Files\Common Files\Symantec Shared\ccApp.exe
0 System -> 1026 UDP
If i were to disable ccApp, that port UDP 123 would be left, and its a system process. Any suggestions as to what that is? Every port listing has just said reserved.Quote:
0 System -> 123 UDP
Anyways... regardless if I still need a firewall to protect that port or not(maybe a way to close it?), I picked up more stuff from this thread han maybe any other thread, so thanks a lot AO...
NEVER apologize for making people think and question things. If we didn't, no one would learn anything. And that is often what is needed the most in Security: for people to learn good habits, get rid of the bad and understand things better.Quote:
Again, I'm very sorry for bringing up a controversial thread, but it's so interesting to me I feel I have to (also sorry for knockin this thread back to the top of the main page).
Now in regards to the ccApp, the question is should it be allowed to run as a service/server? After doing some quick research I found out this about it:
So you may need a firewall in this case (hopefully something a little more than ZA)Quote:
Process File: ccapp or ccapp.exe
Process Name: Common Client CC App
Description: Associated with Norton AntiVirus 2003, which runs auto-protect and email checking facilities. Without this service, both facilities cannot function correctly.
You can use IPSec rules to allow IMCP internally and deny ICMP-ECHO replies externally. This will still allow pinging inside the network itself.