Web Port 80 and IDent 113

I have a 2 computer network. I have file sharing enabled. I am using a Linksys Router Model NR041.Both machines are firewalled with Zone Alarm. One Machine has Windows XP and the other has Windows 98. When I run the the online security scan, it says my Port 80 (web) and Port 113 (ident) are closed. They should be blocked so they can be in stealth mode like all my other ports. Does anyone know why those ports are closed and not Blocked, and is there a way for them to be Blocked (Stealthed)? Thanks :)

Quote:

---

Originally posted here by yourdeadin

if you block ur port 80 then there will be no more browsing for you !


and port 113
Port 113 identd/auth. ... Reveals a lot of information to hackers.
so i guess that you can block port 113
http://www.iss.net/security_center/a...13/default.htm

---

I thought the browser use random port to connect to port 80 of the web server...so blocking local port 80 is not a problem if you doesn't run a local web server.
The online scan is scanning the gateway (router), not your pc...or may be I am wrong?

You can block port 80 perfectly fine. You will be able to keep browsing. You won't be able to host your own webserver though (not configured to use that default port anyways).

Identd is typically used to provide some 'authentication' data when connecting to IRC-networks. You can shut it down and still connect to most networks though, as I understand it.

Quote:

---

if you block ur port 80 then there will be no more browsing for you !

---

WRONG. Please do your research before you give an unknowing person bad information.

Clients use a random port beginning at 1024 + 1. Anything below this is considered priviledged ports for the localhost. The connection then hits port 80 on the REMOTE host, not the localhost.

identd is a simple service to authenticate remote users. It can query which user on a remote system attempts to establish a connection. This service is clear text and no longer in wide use. However, many mail servers will still query it. Some IRC servers use it to verify the userid. What information does IDENT reveal to "hackers"? The worst issues with the service are related to the bad design thus it is subject to buffer overflows, etc.. It's a relic from a time when the internet was a friendly place.

Get your facts in line before you prove to the world that you are without a clue.

I would consult your routers web interface to either create a rule filtering those ports or in some cases a radio button is available to select to specificaly filter said ports. The router should have documentation on how to get there... something like http://192.168.1.1 and entering the default user/pass.

Thanks for the replies guys. The internet security stealth scan (sygate) doesn't scan my routers' assigned IP to each of my computers. It only scans the IP given to me by my ISP. So am I safe since I have a firewall on both of my networked computers. My router uses NAT. ??? :) So i guess i can't stealth my ports 80 and 113, or can I?

The IP assigned by your ISP is going to be the WAN address(or external interface) for your router. This means the online test is scanning your router. I have seen ISPs block ports but usually if they block port 80 they also block common trojan ports and tons of others as well. This leads me to the conclusion your router is responding to the scans with these ports blocked. This is not exactly desired behaviour, but is not terribly serious. If I had to guess (and I'm going too:) ) I would say you need to upgrade the firmware on your router. I have seen linksys firmwares report ports as closed before, and the problem was resolved through a firmware upgrade. As far as the IDENT protocol goes, I would say its not a huge information leak, but it can be used to return the UserID of a particlular TCP connection. This can be used to gather a list of valid accounts for later bruteforce or dictionary attacks on another service, but this scenario is really only troublesome in a multiuser system with services availbale to exploit. (telnet,ssh,etc)

-Maestr0

Ok thanks a lot Maestr0, i'll upgrade my router's firmware right now to see if that fixes the problem.

It seems like the firmware on my router is new than the firmware upgrade available at the website (www.networkeverywhere.com), lol, i guess i'll just keep the firmware that i already have. I have firmware Version 1.2 Release 06, and the one i downloaded (only 1 option), is firmware Version 1.2 Release 03. :)

You may want to try the other one.

-Maestr0

edit: Maybe not.
http://secunia.com/advisories/12393/
Still, cant find anything about ANY releases over 1.2 03. Are sure its 1.2 06?
Their ftp hosts 1.2 01, and 1.2 03

First... Allow me to get this out of the way... Yourdeadin is a moron as noted by TheHorse.....

Now that's out of the way....

There are three states that a scanner will report back to you:-

Open: This is a port that responds to a SYN, (google for the "Three way handshake TCP/IP"), with a SYN/ACK. By doing so it indicates that the port is ready to accept connections for that computer on that port and once the connection is made data can be transferred between the two computers be it benign or malicious.

Closed: Closed means that the port connection attempt returned an RST, (Reset), indicating that even thought there is a computer at the IP address it has no services running on that port so connections are impossible to that IP address on that specific port.

Filtered: This is when the interrogating computer gets _no_ response whatsoever from the tested port. Since the RFC, (google RFC), clearly states that the response to a SYN packet sent to a closed, (no services running), port is an RST yet the scan indicates that there was no response that then there _must_ be a firewall or other filtering device in the way that is simply dropping the packets - hence the "filtered" state.

So... What does this mean for you?

Despite Maestro's "guess" I'm going to make a different one.... :D

At some point you did a "yourdeadin"... and did something stupid.... No offense... This stuff isn't "easy", but it isn't that difficult either.... I think you thought that you have to go to your router and did one of two things.... most likely the second:-

1. You placed yourself in the DMZ of the router.... Unlikely... More ports would show open unless you hardened the box which I don't think you did, or.

2. While doing your "yourdeadin" thing you thought you needed to forward port 80 and 113, and maybe some others that the scanner doesn't report, so that you can "do your thing"....

You don't.... This is a NAT router, (google "How NAT works"), you can run perfectly well without any port forwarded inwards... The router is smarter than "yourdeadin" and will handle the translation for you.... This should all work without your intervention.... Go and check your router and stop all "port forwarding" then try the test again..... You'll be "stealth"... Not that it's a huge deal.... Stealth ports are as accessible as closed ports.... They aren't accessible.... so they aren't a problem....

Ok... Great information Tiger Shark, thanks a lot...:) So i guess i dont have to worry about it since the are 'closed'. :)

I would like to say something about this.

The main difference between Stealth and Closed port is this:

When someone scan your IP for open ports and runs on closed port, tool used for scaning notes that port is there and it is closed, then moves to next port.

when it runs on stealth port it doesn't know is it there or not, so it has to wait for timeout interval.

and above all, if your all ports are stealth there is no proof that your IP realy exists.

Ofcourse, if you are online you have to have at least one open port (above 1024), so if someone is persisten enough to scan for all 64565 ports, he will eventualy confirm that your IP is online....

Alright, I get it perfectly now. :) Thanks Ikalo. great info guys... Thank you all for your answers and opinions.

Quote:

---

Ofcourse, if you are online you have to have at least one open port (above 1024),

---

WRONG. What if I'm serving up a website and *only* have port 80 *listening*? Does this mean I'm not online?

It's clear that you don't understand the difference between an established connection and a listening port.

Quote:

---

if your all ports are stealth there is no proof that your IP realy exists.

---

I wont even comment on this.

I dunno.... This thread seems to be attracting all the.... er.... dimwits..... :rolleyes:

Ikalo...... ALL YOUR PORTS ARE THERE ALL THE TIME.... period.... If there is no service listening on the port for connections then the port is CLOSED!!!! Closed means that when the IP address receives a SYN from ANY other computer it will return an RST indicating that the port is not avaliable for ANY kind of communication......

Next.... Ports above 1024 are DYNAMICALLY appropriated by the operating system for outbound communication with ports below 1024 in most circumstances unless there is a service that is assigned a high port number for a reason - of which there are numerous, but, in the normal operation of a home or even business/server computer they are not normally listening/open ports... Thus, scanning the ports from 1024 to 65535 on any normal computer will turn up nothing....

On the bright side you are kind of right.... If your _all_ your ports turn up as "stealth" on one of these checks it is possible to believe that the computer is either turned off or does not exist.... But you would be wrong in thinking that. There are a whole bunch of other little "tests" that can be run that will indicate that the computer is there and online.... Read the RFC's and then use your creativity to determine how that might be done....

What you are talking about in your "meandering" is that a scan time can be extended when the target is properly filtered becuase your scanner will have to accept the potential for packet loss and retry the connection on properly filtered packets. What you do need to understand is that if I "want" you badly enough I'm quite prepared to wait for the scan to finish, even if I told it to be paranoid and most of your ports are "filtered/stealth"

Stealth is a myth and only keeps out the uninformed and stupid......

There.... another myth shattered....

Hoss: You need to type more.... You're wearing out my fingers with your one liners..... ;)

Kyrios: Yes, you do need to worry about "closed" ports.... sort of.... While no-one can connect to them they do know, easily, that you are there. You are behind a router that, for "normal" connections should show you as non-existent.... Clearly you have ports open through the router/firewall.... I, personally, would want to see them closed.... but thats my personal feeling on the subject....

Tiger,

I couldn't agree more. However, it's not just this thread. There seems to be a flood of misinformation hitting this site lately. I have no problem educating those who are truly searching for answers just like I have no problem smacking the fingers of those who seed AO threads with bad information.

How's that?

;)

Quote:

---

On the bright side you are kind of right.... If your _all_ your ports turn up as "stealth" on one of these checks it is possible to believe that the computer is either turned off or does not exist.

---

Don't pacify him. We both know that scanning a host using the 1024-65535 range (for discovery purposes) is considered bad practice and would get both of us fired in a heartbeat. You already sealed the deal. "Stealth" is BS. Period.

:)

Quote:

---

How's that?

---

I call it fair....

Quote:

---

Don't pacify him.

---

You're right.... but I'm basically a "nice guy".... Well, according to sweetie I was.... twice... :)

I agree about the misinformation... But it seems to be a cyclical thing... There is a core here that know there stuff and a rotating group that get comfortable with posting and then spread their m/disinformation until they are "put down".... We seem to be in the high point of a cycle of idiots.... But that might just be the "nice guy" in me talking.... :rolleyes:

Ok, I did a little checking and here is what I believe the low-down is. As Tiger mentioned there are really only 3 things a port does, eiither its open, its closed, or it wont answer (filtered). I'm really not sure where the whole 'Stealth' idea came from and why saying 'filtered' wasnt good enough but thats beside the point. The router you are using is a NAT device. Most routers will 'filter' or not respond to incoming connections. This is really because of NAT, the incomings have nowhere to be routed to, so of course the get no answer. There is one exception to this: IDENT. Some services (IRC) will want to do an IDENT lookup on new connections. If the IDENT request hits a closed port, no big deal, the server says "he's not running IDENT, it's cool" However if the IDENT port is filtered the request actually has to time out and in some cases my prevent you from making a connection. Since router manufacturers dont want the word on the streets to be that their router sucks, many routers will actually respond with a RST on 113 so the port reports being 'closed'. So this explains why 113 is closed but what about 80? Well, doing some google'ing revealed that there is a flaw in the firmware of this model (even the most current version) that forwards port 80 to the first port on router, regardless of anything you do (disabling it doesnt help) Now, I cant swear to this, its just what some ******* on the intenet posted, so you may want to call the manufacturer and confirm this. But it could be 80 is getting forwarded in to one of the boxes which is simpy reporting the port closed.


-Maestr0

OK, i see, so the bottom line is that my router sucks, i did buy it for $39.99. Hopefully they update the firmware soon. O well, it serves it's purpose and the purpose is making one internet connection into 2 and letting my PCs communicate with each other. Although the router has its flaws, because before i bought it, i had a direct connection from the cable modem to my computer, and when i ran the security tests, every single port of mine was stealthed/filtered, so i guess there really isn't anything i can do... Because i really dont want to buy another router, so i guess i'll just have to live with port 80 and port 113 being closed, and not stealthed/filtered. :) Thanks to all for your investigation and comments on this matter. :)

The Horse, Tiger

Thank you for your critics.

I'm sorry if I mislead someone newbie. On the other hand, if I don't express my opinion, how could someone with more knowledge correct me.

I guess that I'll have to include some kind of disclaimer that my words should not be taken without confirming from someone else.

Thank you one more time.