RE: discovering a service behind a nated network

From: Mike (mike_at_superiorholidayadventures.ca)
Date: 09/07/04

  • Next message: Elliott Bäck: "Re: [lists] Web ports list" 
    Date: Tue, 7 Sep 2004 15:27:01 -0400
To: "linux user" <linuxteam@gmail.com>, <security-basics@securityfocus.com>

    > I would like to discover if a service that is behind a NATed network
    > is still working, for
    > example if a web server is in a private network, Nated behind a
    > gateway, how could i from an external network check if the server is
    > down/ or there are network problems between the server and the
    > gateway? is there a way to use a tool such as traceroute for
    > NATed/Firewalled network from an external link?

    You can telnet into most ports and see if there's a banner served. If
    it's specifically a webserver you're testing you could issue the command
    "GET / HTTP/1.0", or issue the appropriate HTTP 1.1 commands. You could
    also just point a web browser at the IP or domain name. Doing the above
    should tell you if the service is up behind the NAT box.

    If it's a network issue between the client and the server, your typical
    network troubleshooting commands are your best friend
    (tracert/traceroute, ping).

    You may also end up diagnosing possible DNS problems.

    > another reason is howto troubleshoot a service that has been port
    > forwarded from
    > the gateway, the port forwarding works for other services, but this
    > specific service is not reachable, and you can not tell whether the
    NATed
    > box
    > was down, or the route was down, or what, you could debate that you

    Well, if the same box forwards other ports but does not forward a
    specific port, or that specific port/service no longer works, I would
    say that it is *not* a problem with the NAT box and rather a problem
    with the destined host.

    Hope that helps,

    Mike Fetherston

    ---------------------------------------------------------------------------
    Computer Forensics Training at the InfoSec Institute. All of our class sizes
    are guaranteed to be 12 students or less to facilitate one-on-one
    interaction with one of our expert instructors. Gain the in-demand skills of
    a certified computer examiner, learn to recover trace data left behind by
    fraud, theft, and cybercrime perpetrators. Discover the source of computer
    crime and abuse so that it never happens again.

    http://www.infosecinstitute.com/courses/computer_forensics_training.html
    ----------------------------------------------------------------------------

  • Next message: Elliott Bäck: "Re: [lists] Web ports list"

    Relevant Pages

    • Re: Fully parallel Scheme-based language w/ evaluator
      ... Windows Server 2003 and networks in simple - and irreverent - terms. ... If networking really is a big deal, ... Concepts and Terminology in Part I, and The Design and Deployment of Network ...
      (comp.lang.misc)
    • Re: Hacked?
      ... have some kind of pointer to try to contact a computer on that network. ... Those are NetBIOS ports, and NetBIOS is somewhat chatty and can generate ... installing Zone Alarm on the computer in question would be ... > currently hosting the email server, DNS, as well ...
      (microsoft.public.security)
    • Re: IIS / Web Services Security threats
      ... You will be surprised to know, due to a recent virus attack on the perimeter network, the common ports have been closed too. ... I also develop Java applications which runs on weblogic server. ... Since, the entire world knows about port 80 and 443, I thought opening a specific port with IP Sec configuration may make the network little secure. ... My security team thinks allowing communication between the two IIS ...
      (microsoft.public.dotnet.framework.webservices)
    • Re: Getting around corporate firewalls to access ssh server
      ... the ports on the two servers and put the release server on 22. ... restrictive of what the users are allowed to do with the network. ... For those customers where you are having problems, ...
      (comp.os.linux.networking)
    • Re: When do I choose for OUTBOUND or INBOUND in a protocol?
      ... Ori YosefiISA Server Team ... > tab I only checked the external network. ... >> If you want to allow access to iSpQ on the internal network, you should>> create a publishing rule that publishes these ports to the external> network. ...
      (microsoft.public.isa)