RE: Port Zero

From: Jim Harrison (ISA) (jmharr_at_microsoft.com)
Date: 07/18/05

  • Next message: Lee Dilkie: "Re: Port Zero" 
    Date: Mon, 18 Jul 2005 08:50:07 -0700
To: "Wimpie du Plessis" <wimpie@issecurity.co.za>, <omibaba@gmail.com>, <incidents@securityfocus.com>

    This is correct.
    Netstat is showing you that those listeners are waiting to accept
    traffic from (Foreign address) any IP (0.0.0.0) and any port (:0).

    Jim Harrison
    Security Business Unit (ISA SE)
    "When you come to a fork in the road, take it."

    --Yogi Berra

    -----Original Message-----
    From: Wimpie du Plessis [mailto:wimpie@issecurity.co.za]
    Sent: Sunday, July 17, 2005 11:59 PM
    To: omibaba@gmail.com; incidents@securityfocus.com
    Subject: RE: Port Zero

    Hi, I would think that it is cause it is listening and therefore it wont
    know the foreign address source port, thats why it is set to zero, it
    will
    accept any src port coming into that listening port.

    -----Original Message-----
    From: omibaba@gmail.com [mailto:omibaba@gmail.com]
    Sent: Saturday, July 16, 2005 6:14 AM
    To: incidents@securityfocus.com
    Subject: Port Zero

    Active Connections

      Proto Local Address Foreign Address State
      TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
      TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
      TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING
      TCP 0.0.0.0:1028 0.0.0.0:0 LISTENING
      TCP 0.0.0.0:1054 0.0.0.0:0 LISTENING
      TCP 0.0.0.0:1307 0.0.0.0:0 LISTENING
      TCP 0.0.0.0:1344 0.0.0.0:0 LISTENING
      TCP 0.0.0.0:1445 0.0.0.0:0 LISTENING
      TCP 0.0.0.0:1447 0.0.0.0:0 LISTENING
      TCP 0.0.0.0:1452 0.0.0.0:0 LISTENING
      TCP 0.0.0.0:1453 0.0.0.0:0 LISTENING
      TCP 0.0.0.0:1455 0.0.0.0:0 LISTENING
      TCP 0.0.0.0:1460 0.0.0.0:0 LISTENING
      TCP 0.0.0.0:1465 0.0.0.0:0 LISTENING
      TCP 0.0.0.0:1466 0.0.0.0:0 LISTENING
      TCP 0.0.0.0:1469 0.0.0.0:0 LISTENING
      TCP 0.0.0.0:1491 0.0.0.0:0 LISTENING
      TCP 0.0.0.0:1496 0.0.0.0:0 LISTENING
      TCP 0.0.0.0:1498 0.0.0.0:0 LISTENING
      TCP 0.0.0.0:1507 0.0.0.0:0 LISTENING

    Above is the output of netstat -an |more

    Guys / Gals Do you know what means port zero in Windoze Platform ? I
    know
    the answer but jst wanted to know anyone has a better explaination.

    In Unix Family port zero is used for socket programming but not the same
    in
    Windoze family.

    I have asked this question in many programs of mine in CEH - Certfied
    Ethical Hacking but still awaiting for answers. Lemme see if can get
    some
    answers for this post!!!!

    Ciao

    Baba
    CEO
    Appsec

  • Next message: Lee Dilkie: "Re: Port Zero"

    Relevant Pages

    • Re: Best Plan of action for 2 forest.......
      ... PortQry reports the status of a port in one of the following ways: ... ..LISTENING This response indicates that a process is listening on the target ...
      (microsoft.public.windows.server.active_directory)
    • Re: RIP issue with HMC - security violation?
      ... using an UDP port, 520, which would normally imply that there was a Routing ... Information Protocol (RIP) process behind it capable of modifying the routing ... as a "listening" state for the application. ...
      (bit.listserv.ibm-main)
    • Re: RealVNC
      ... If we are talking about RealVNC it goes this way ... Then there is default Java listening port on port 5800 on the client machine ...
      (microsoft.public.windows.server.sbs)
    • Re: Cant join a domain
      ... Attempting to resolve name to IP address... ... TCP port 42: NOT LISTENING ...
      (microsoft.public.windows.server.active_directory)
    • Re: Cant join a domain
      ... Attempting to resolve name to IP address... ... TCP port 42: NOT LISTENING ...
      (microsoft.public.windows.server.active_directory)