Web Port 80 and IDent 113

First... Allow me to get this out of the way... Yourdeadin is a moron as noted by TheHorse.....

Now that's out of the way....

There are three states that a scanner will report back to you:-

Open: This is a port that responds to a SYN, (google for the "Three way handshake TCP/IP"), with a SYN/ACK. By doing so it indicates that the port is ready to accept connections for that computer on that port and once the connection is made data can be transferred between the two computers be it benign or malicious.

Closed: Closed means that the port connection attempt returned an RST, (Reset), indicating that even thought there is a computer at the IP address it has no services running on that port so connections are impossible to that IP address on that specific port.

Filtered: This is when the interrogating computer gets _no_ response whatsoever from the tested port. Since the RFC, (google RFC), clearly states that the response to a SYN packet sent to a closed, (no services running), port is an RST yet the scan indicates that there was no response that then there _must_ be a firewall or other filtering device in the way that is simply dropping the packets - hence the "filtered" state.

So... What does this mean for you?

Despite Maestro's "guess" I'm going to make a different one.... :D

At some point you did a "yourdeadin"... and did something stupid.... No offense... This stuff isn't "easy", but it isn't that difficult either.... I think you thought that you have to go to your router and did one of two things.... most likely the second:-

1. You placed yourself in the DMZ of the router.... Unlikely... More ports would show open unless you hardened the box which I don't think you did, or.

2. While doing your "yourdeadin" thing you thought you needed to forward port 80 and 113, and maybe some others that the scanner doesn't report, so that you can "do your thing"....

You don't.... This is a NAT router, (google "How NAT works"), you can run perfectly well without any port forwarded inwards... The router is smarter than "yourdeadin" and will handle the translation for you.... This should all work without your intervention.... Go and check your router and stop all "port forwarding" then try the test again..... You'll be "stealth"... Not that it's a huge deal.... Stealth ports are as accessible as closed ports.... They aren't accessible.... so they aren't a problem....

Ok... Great information Tiger Shark, thanks a lot...:) So i guess i dont have to worry about it since the are 'closed'. :)

I would like to say something about this.

The main difference between Stealth and Closed port is this:

When someone scan your IP for open ports and runs on closed port, tool used for scaning notes that port is there and it is closed, then moves to next port.

when it runs on stealth port it doesn't know is it there or not, so it has to wait for timeout interval.

and above all, if your all ports are stealth there is no proof that your IP realy exists.

Ofcourse, if you are online you have to have at least one open port (above 1024), so if someone is persisten enough to scan for all 64565 ports, he will eventualy confirm that your IP is online....

Alright, I get it perfectly now. :) Thanks Ikalo. great info guys... Thank you all for your answers and opinions.

Quote:

---

Ofcourse, if you are online you have to have at least one open port (above 1024),

---

WRONG. What if I'm serving up a website and *only* have port 80 *listening*? Does this mean I'm not online?

It's clear that you don't understand the difference between an established connection and a listening port.

Quote:

---

if your all ports are stealth there is no proof that your IP realy exists.

---

I wont even comment on this.

I dunno.... This thread seems to be attracting all the.... er.... dimwits..... :rolleyes:

Ikalo...... ALL YOUR PORTS ARE THERE ALL THE TIME.... period.... If there is no service listening on the port for connections then the port is CLOSED!!!! Closed means that when the IP address receives a SYN from ANY other computer it will return an RST indicating that the port is not avaliable for ANY kind of communication......

Next.... Ports above 1024 are DYNAMICALLY appropriated by the operating system for outbound communication with ports below 1024 in most circumstances unless there is a service that is assigned a high port number for a reason - of which there are numerous, but, in the normal operation of a home or even business/server computer they are not normally listening/open ports... Thus, scanning the ports from 1024 to 65535 on any normal computer will turn up nothing....

On the bright side you are kind of right.... If your _all_ your ports turn up as "stealth" on one of these checks it is possible to believe that the computer is either turned off or does not exist.... But you would be wrong in thinking that. There are a whole bunch of other little "tests" that can be run that will indicate that the computer is there and online.... Read the RFC's and then use your creativity to determine how that might be done....

What you are talking about in your "meandering" is that a scan time can be extended when the target is properly filtered becuase your scanner will have to accept the potential for packet loss and retry the connection on properly filtered packets. What you do need to understand is that if I "want" you badly enough I'm quite prepared to wait for the scan to finish, even if I told it to be paranoid and most of your ports are "filtered/stealth"

Stealth is a myth and only keeps out the uninformed and stupid......

There.... another myth shattered....

Hoss: You need to type more.... You're wearing out my fingers with your one liners..... ;)

Kyrios: Yes, you do need to worry about "closed" ports.... sort of.... While no-one can connect to them they do know, easily, that you are there. You are behind a router that, for "normal" connections should show you as non-existent.... Clearly you have ports open through the router/firewall.... I, personally, would want to see them closed.... but thats my personal feeling on the subject....

Tiger,

I couldn't agree more. However, it's not just this thread. There seems to be a flood of misinformation hitting this site lately. I have no problem educating those who are truly searching for answers just like I have no problem smacking the fingers of those who seed AO threads with bad information.

How's that?

;)

Quote:

---

On the bright side you are kind of right.... If your _all_ your ports turn up as "stealth" on one of these checks it is possible to believe that the computer is either turned off or does not exist.

---

Don't pacify him. We both know that scanning a host using the 1024-65535 range (for discovery purposes) is considered bad practice and would get both of us fired in a heartbeat. You already sealed the deal. "Stealth" is BS. Period.

:)

Quote:

---

How's that?

---

I call it fair....

Quote:

---

Don't pacify him.

---

You're right.... but I'm basically a "nice guy".... Well, according to sweetie I was.... twice... :)

I agree about the misinformation... But it seems to be a cyclical thing... There is a core here that know there stuff and a rotating group that get comfortable with posting and then spread their m/disinformation until they are "put down".... We seem to be in the high point of a cycle of idiots.... But that might just be the "nice guy" in me talking.... :rolleyes:

Ok, I did a little checking and here is what I believe the low-down is. As Tiger mentioned there are really only 3 things a port does, eiither its open, its closed, or it wont answer (filtered). I'm really not sure where the whole 'Stealth' idea came from and why saying 'filtered' wasnt good enough but thats beside the point. The router you are using is a NAT device. Most routers will 'filter' or not respond to incoming connections. This is really because of NAT, the incomings have nowhere to be routed to, so of course the get no answer. There is one exception to this: IDENT. Some services (IRC) will want to do an IDENT lookup on new connections. If the IDENT request hits a closed port, no big deal, the server says "he's not running IDENT, it's cool" However if the IDENT port is filtered the request actually has to time out and in some cases my prevent you from making a connection. Since router manufacturers dont want the word on the streets to be that their router sucks, many routers will actually respond with a RST on 113 so the port reports being 'closed'. So this explains why 113 is closed but what about 80? Well, doing some google'ing revealed that there is a flaw in the firmware of this model (even the most current version) that forwards port 80 to the first port on router, regardless of anything you do (disabling it doesnt help) Now, I cant swear to this, its just what some ******* on the intenet posted, so you may want to call the manufacturer and confirm this. But it could be 80 is getting forwarded in to one of the boxes which is simpy reporting the port closed.


-Maestr0

OK, i see, so the bottom line is that my router sucks, i did buy it for $39.99. Hopefully they update the firmware soon. O well, it serves it's purpose and the purpose is making one internet connection into 2 and letting my PCs communicate with each other. Although the router has its flaws, because before i bought it, i had a direct connection from the cable modem to my computer, and when i ran the security tests, every single port of mine was stealthed/filtered, so i guess there really isn't anything i can do... Because i really dont want to buy another router, so i guess i'll just have to live with port 80 and port 113 being closed, and not stealthed/filtered. :) Thanks to all for your investigation and comments on this matter. :)