telent to port 21

well this is a very simple problem ..
when I telnet to other ports of a computer in my network it ussually give me this error ..
connecting to 10.100.*.* ... could not open connection to that host on port <port no#>: connection failed

however when I connect to it on port 21 .. the following happens
I get a blank screen
after the first charecter I type on the screen I get back my computer prompt with the charecter I had typed displayed above it ..

if I have not been clear please tell me I'll take some screen shots and try to explain what I mean

if some one could please tell me why this is happening I shall be gratefull

btw am still upset over those negs :'( ..

thanking you in advance ..

well this is a very simple problem ..
when I telnet to other ports of a computer in my network it ussually give me this error ..
connecting to 10.100.*.* ... could not open connection to that host on port <port no#>: connection failed

however when I connect to it on port 21 .. the following happens
I get a blank screen
after the first charecter I type on the screen I get back my computer prompt with the charecter I had typed displayed above it ..

if I have not been clear please tell me I'll take some screen shots and try to explain what I mean

if some one could please tell me why this is happening I shall be gratefull

btw am still upset over those negs :'( ..

thanking you in advance ..

Do you have the server installed? Is it running? Is the port open?

Do you have the server installed? Is it running? Is the port open?

Quote:

---

btw am still upset over those negs :'( ..

---

Dont whine about negs.... ;)

only gets you more

MLF

Quote:

---

btw am still upset over those negs :'( ..

---

Dont whine about negs.... ;)

only gets you more

MLF

I'm sorry
I forgot to mention that no server is running what I want to know is why doesnt it give my the same response for the ftp port as it did for the others. All ports are closed i had first telneted to port 80 that gave the error message and later to port 21. The computer isnt mine but my roommates I had asked him to close both ports and no server was running i checked myself.

once again thank you.

I'm sorry
I forgot to mention that no server is running what I want to know is why doesnt it give my the same response for the ftp port as it did for the others. All ports are closed i had first telneted to port 80 that gave the error message and later to port 21. The computer isnt mine but my roommates I had asked him to close both ports and no server was running i checked myself.

once again thank you.

Hey Hey,

A couple of things would be useful here...

Screen Shot to Clarify what you mean
Output from Netstat -an
and possibly output from fport (that could come later if needed)...

Throw those up and we'll take a look through... Since it's a 10. address you really don't have to worry about masking it...

Peace,
HT

Hey Hey,

A couple of things would be useful here...

Screen Shot to Clarify what you mean
Output from Netstat -an
and possibly output from fport (that could come later if needed)...

Throw those up and we'll take a look through... Since it's a 10. address you really don't have to worry about masking it...

Peace,
HT

hey yea will do
sry i couldnt reply eariler its really late here I'll post it as soon as I can thanks man

hey yea will do
sry i couldnt reply eariler its really late here I'll post it as soon as I can thanks man

well I cant edit the above post so I'll have to make a double post my apologies for that and for the delay in replying. Univ. was kinda hectic this week we are kicking off our tech-fest and our profs decieded we needed to submit all assignments this week itself.

Here are the screen shots as asked I'm still puzzelled as to why is there a difference between the response to telneting to 21 and other ports .. any help would be welcome.

and once again thanks for hepling so far

Hey Hey,

You need to run netstat -an (need to see listening connections)..


fport and PortQry2 results would also be nice... you can google for either of them and download them easily enough... especially PortQry2

Peace
HT

ok heres the screenshot for both fport and for netstat -an

i couldnt find portqry2 ...

Hey Hey,

I don't see port 21 listening on your computer... I'm really not sure what you're doing.. is it still open now??? Have you considered port scanning yourself.. to see exactly what is open..

You can grab superscan from here http://www.foundstone.com/index.htm?...superscan4.htm

Peace,
HT

hey it seems i havent been able to ask my Q properly or somthing cause I know that the port is locked tight as possible (norton and all take care of that) what I was asking was why when i telnet to the port 21 it gives me a different response than when i telnet to the http port or any other port when they are all locked down.

thats what i was trying to say any way

Quote:

---

I forgot to mention that no server is running what I want to know is why doesnt it give my the same response for the ftp port as it did for the others. All ports are closed i had first telneted to port 80 that gave the error message and later to port 21. The computer isnt mine but my roommates I had asked him to close both ports and no server was running i checked myself.

---

and why does this difference arise only within the ftp port and the others and not for eg. port 79 and port 80 or port 35 and port 80 ..

the computer Im telnetting to is my roommates and the one I'm telneting from is mine.

Hey Hey,

If you're attempting to connect to your roommate queries, then all the images you gave me would have to come from your roommates computer... netstat run on it.. fport run on it.. etc.

Peace,
HT

they are from my roommates computer

Hi


Let me summarise:

The PC 10.100.98.45 seems to have something listening
on port 21 - if you telnet to it, you get an empty
window, the prompt is blinking, waiting for input.
Telnet to a web-server on Port 80 - you will see the
same behaviour.

Netstat does not show anything listening on port 21.
Is that version of netstat trustworthy? Therefore,
let's try another, external one:

fport. Again, fport does not indicate that anything is
listening on port 21.



It would be interesting to perform a nmap-scan[1]

Code:

---

>nmap -sS -sV -F 10.100.98.45

---

from your computer - maybe there are some hints?


I once had a machine like this - I re-initiated the
original ghost file (although it would have been interesting
to isolate the listening process/program/rootkit, but I had
no time). The reason for this is that it might be a
kernel-mode rootkit[2]. Your friend has installed
PeerWeb DC++? File sharing? What else did he install?
Is the machine "clean"? I assume - not.



Cheers

[1] http://www.insecure.org/nmap/download.html
[2] http://www.sysinternals.com/Utilitie...tRevealer.html

yeah well peerweb DC++ is the new in thing in college so almost every one on lan has it .. and well we use it only for our internal purposes and more and more for internal chating and all than for actual file sharing .

as for somthing listening on port 21 it seems so but then why does that prompt always close down either after the first charecter i type or after a specified time of no actvity (maybe some timeout setting) he shouldnt have anything running on that port cause well ... he hasnt set up any server or anything and i think he's got macafee so decent firewall and all ... although i know that it doesnt make him invulnerable but some protection ....

but yeah you did manage to put it put it down pretty well ill give you the result of that nmap scan as soon as he gets back

edit :
ok heres the result .. saved in the screenshot ..

sry people didnt notice that the edit didnt allow an upload of the picture

Hmm nmap shows filtered other than 139 & 445... which means there is some sort of firewall between yourself and the remote, as you have said....

Maybe your 'hanging' is because the packets are dropped which means that your local doesn't know anything about the remote and as u said the timeout on the local telnet app is quite long.

But when u try to send another (ie when you type) it rejects the packet (sequence non-existent or some other rule)...

What error were you receiving on port 80? can we have a screenshot of the 'test' telnet process you are executing?

well they are there in that first zip file it contains screenshots of both telnet to 80 , 21 and to 23 ... and the result of a "netstat -n" on his pc

and yea i think im beginnin to understand what you are saying but that still doesnt explain why the difference is arising .. (or maybe i havent understood completely)

What is showing up in the firewall log of the box you are telneting too?

hmm... actually never checked .. ill get back to you as soon as i can but I'm not that familiar with his firewall so it might take me some time so check .. but ill get back you on that

well now wierdly enough now my roommate doesnt want me messing with his firewall logs
( I guess all these Dbase guys dont trust any one) so sorry people.
but any wya tahnks for taking interest, and taking the time to help me I just wish I could have found out what was happening.
once again thank you all.

Okay, first of all, are you an admin. If you are not then that is why you cannot do the telnet.

I'm not to sure about the reason for you wanting to telnet to places so I will give any details as too why.

am I an Admin as in ???
yeah on my computer I was using the Admin account. but nope its a college network so Im not the Admin on the network. Maybe thats the reason.

edit:
sorry forgot to add the reason I was telnetting - well wierdly enough just for the heck of it there are very wiered things that a guy can find on a LAN and he can learn alot from it as well if he just does stuff for fun :D .

[rant ] as an example -- In my college labs we have a 20 MB account limit and very restricted rights. however I found that if we were to logon from the graduate labs we could get an administravtive account on that computer. that is because of some mistake they had made since this happened only when the computer couldnt log us on to our roaming profile and made a temporary local profile. and yeah we did tell the admins.
[end rant]