Port scanning question...

That was always Zone Alarms good feature, it seemed to always do a good job at stealthing ports.
Make sure you have the latest versions of WinPcap, ethereal, wireless drivers and all that. I can't think of why it wouldn't work as long as ethereal or windows can see the wireless network connection. Some software drivers take control away from windows and you have to play with them. But any way, have fun. :)

//EDIT I was thinking about the interface from Layer 1 to Layer 2 on windows boxes. So I poked around a bit and you card has to support rfmon, or "monitor" mode. For this reason I bought a card just for monitoring, an old Orinco. I use linux for the most part but I found this here:

Quote:

---

On Windows, you will not be able to capture in monitor mode on any interfaces, and you might not be able to capture in promiscuous mode, either. You might have some success in promiscuous mode with Centrino interfaces, although you will need Ethereal 0.10.6 or later in order to have the non-data packets recognized and properly dissected.

---

...I'll have to pick up an Orinco. Pretty sure I've got the latest on WinPcap, ethereal, wireless drivers and all that. Seems I'd read about the same on Windows and Ethereal. I'd like to run Knoppix STD off the CD if need be.

in case of ICMP blocked messges use firewalker instead..
it can pass beyond most of the firewalls using random udp port around 56 port used for dns requests..
while using nmap may not be handy in this case bcoz it works only wen most firewall is not blocking ..
u can also use fin scanning using nmap if it works ..
ashtified

hi brokencrow,

I'll take another step. If you move over to linux for this, then with an orinco card you just opened a new can of woop azz. Windows, well pretty much suxors on the security tool list. You can use kismet and then dump the log into ethereal for a nice picture and some IDS componenets. There are some excellent war tutorials on this site so browse through them.

I can see why you might want to ban some serious abusers, but don't you risk pissing off some customers? Maybe your router supports some bandwidth throttles? I mention this because if it were me being scanned, I would not be happy.

...everybody's PO'ed when the bandwidth is gone. :(

We only had to do this once before, back in October. It stinks, but free, easy-to-access bandwidth is part of this coffeehouse's biz. When you get somebody who's parked permanently on the cloud, bumping everybody else off, well, what do you do? Back in October when I did this, I got immediate feedback, and I went upstairs and cleared those machines of any rogue programs and coached the staff members on proper computer hygiene. Guess it didn't take, or maybe it did for awhile. I haven't heard a thing this time around, and they still got two computers on the cloud. So they've got some internet access in the office and probably haven't even figured it out yet. He-heh, here's what's interesting: the two computers still on the cloud are used by chicks, the two that got the boot are used by guys. I'll give you three guesses the kind of sites the guys are going to! :)

Ashtified, you got a download site for firewalker? Did a quick google, but turned up little other than some odd references here and there. Is there a Winders port?

It'll probably be another month or so before I spring for another wireless card. Fortunately this is not a day-to-day problem, but only occurs every few months.

...port scanning is a fact of life on the net. I admin a small network up in Shawnee country (Ohio) that I put a Smoothwall on. I regularly go in and check the logs and it's amazing who's checking the doors. I even seen DoD ip's coming in on port 666 and all I could figure was some gubmint guy looking for a Doom game on a slow day. Our tax dollars at work...

Quote:

---

...port scanning is a fact of life on the net.

---

Sure is, and coming from the "net" is one thing. Coming from within the same network I connected too, over my staight up shot of espresso, could be taken as hostile. That's all I was pointing out. But if there is no bandwidth then there is a problem. Another step. There are alternatives to client invasion. For instance, each internet connection should be presented at the border router/firewall in some fashion because its nating the address (note I am just guessing you use nat but 99.99 sure). So outside of learning, it's a waste to go and try to probe stealthed PCs. Their connection is documented and most likely logged. And if not logged then tables are there in real time. They have to be.

...the DHCP table on the Linksys gives me no realtime info. I can clear it, then renew it, and it'll stay empty until the next time a client logs into the network. A $60-70 router won't tell you much in realtime. Fact is, most folks got no idea they're being scanned, much less even know what a logfile is.

And I respectively disagree with you that port scanning is an invasion. It's an essential admin tool that I've seen used on a slew of networks from time to time. The ping scan gives me a basic feel for who's pulling lot the bandwidth based on the ms time, and that's all I need to know. I could care less about making an intrusion into someone's computer. Furthermore, we've only scanned like that after a few days of problems. It's not like we do it on a regular basis.

You disagree with me even though it's an open public netowrk with no warnings? That's cool, we have a different philosphy here. I am looking from a point of view, I come into a public network, get a connection and wham, I am scanned on every port. Now if I was on a public machine, not my own or connecting to a private network, I would have a different view point. But only slightly modified. I would instantly think the operator was up to something or some smack head on the couch sipping his milky latte. By intrusive I didn't mean you actually entered a client, just that a sweep could be considered intrusive by a user.

You don't have access to NAT tables or ARP tables? That's a bummer. What linksys do you have?

//EDIT You can also look at the DSL or Cable modem for console access or remote access. A ping is NOT a vailid test for bandwidth consumption through your internet gateway. Sorry but it's not as reliable as you think. Consider where you are connected in reference to the client and the technology you are using. In your case it may if the actuall wireless link is slow. In tests I have done, someone could be using up a 100k and a ping would show no difference in time from the resting client and one using 100k.

...it's probably more accurate to say it's a private network available to the public. And who knows what goes on when you got half-a-dozen users hangin' around?

Me? I ALWAYS assume I might be scanned at any time, big deal. I'm inured of this stuff anymore since I've delved deeper into networking and firewalls. Personally, I don't consider scans to be intrusive, and apparently the courts agree. That may change though, and certainly it's considered unethical in some circles. But hey, you got to admin the network somehow.

Sheesh, you should see the software, like IRIS, that the big boys use on those corporate networks. Yow, they can read ANYTHING. I even had a guy hire me to install keyloggers once on his network of five computers. I had mixed feelings about doing that job, but they're his computers and that's what he wanted. The guy was a control freak. Fortunately for his employees, reading the logs was too time-consuming and he was a putz. Thought I'd never say this, but there is no privacy (unless you know what you're doing and are willing to work for it). Welcome to the real world...