Re: Open Ports on Cisco Router

From: Vladamir (wireless.insecurity_at_gmail.com)
Date: 03/28/05

  • Next message: adisegna_at_siscocorp.com: "RE: Open Ports on Cisco Router" 
    Date: Mon, 28 Mar 2005 13:53:59 -0500
To: bob bob <bb88011@yahoo.com>

    Just as a safety precaution, you should issue:

    no ip tcp-small-servers
    no ip udp-small-servers

    It'll get rid of Time, Echo, Chargen, etc.

    bob bob wrote:
    > I have a Cisco 1720 router that showed telnet open
    > after a recent audit. I closed down telnet by
    > applying an acl to the vty lines and then nmap'ed from
    > the outside to verify. Telnet is indeed closed, but
    > other ports appeared open now! What's more, different
    > ports appear open when scanning at different times.
    > It showed tcp ports 21, 25 and 80 open at one time,
    > but in another scan showed 143 in addition to the
    > above. Late in the evening, it showed none of the
    > above open, but a range of ports starting around 8000.
    > No UDP ports show open.
    >
    > I ran nmap with the following command:
    >
    > nmap -sT -P0 -sV -v -p 1-65535 A.B.C.D
    >
    > Here is a portion of the router config:
    >
    > version 12.3
    >
    > . . .
    > ip subnet-zero
    > no ip source-route
    >
    > . . .
    > interface FastEthernet0
    > ip address 10.0.0.1 255.255.255.0
    > ip nat outside
    > speed auto
    > half-duplex
    > !
    > interface Serial0
    > ip address A.B.C.D 255.255.255.252
    > ip access-group filter_outside_in in
    > no ip redirects
    > no ip unreachables
    > no ip proxy-arp
    > no nat outside
    > no fair-queue
    > no cdp enable
    > !
    > ip nat inside source list 10 interface Serial0
    > overload
    > ip classless
    > ip route 0.0.0.0 0.0.0.0 Serial0
    > no ip http server
    >
    > . . .
    >
    > ip access-list extended filter_outside_in
    > deny ip 10.0.0.0 0.255.255.255 any
    > deny ip 127.0.0.0 0.255.255.255 any
    > deny ip 172.16.0.0 0.15.255.255 any
    > deny ip 224.0.0.0 15.255.255.255 any
    > deny ip host 0.0.0.0 any
    > deny icmp any timestamp-request
    > deny icmp any redirect
    > deny icmp any mask-request
    > deny icmp any traceroute
    > deny icmp any echo
    > permit ip any any
    > access-list 10 permit 10.0.0.0 0.0.0.255
    > ----------------------------------------
    >
    > So, the router is NAT'ing, and, btw, it also has a
    > firewall behind it. The ports that show up in the
    > scans of the router match up very well with the ports
    > used regularly at this location, so I thought it might
    > have something to do with NAT dynamically openning
    > ports. However, it still seems very strange to me and
    > I wanted to know if anyone else has seen this behavior
    > and what explains it. TIA!
    >
    > Bob
    >
    >
    >
    >
    > __________________________________
    > Do you Yahoo!?
    > Yahoo! Small Business - Try our new resources site!
    > http://smallbusiness.yahoo.com/resources/
    >

  • Next message: adisegna_at_siscocorp.com: "RE: Open Ports on Cisco Router"

    Relevant Pages

    • Open Ports on Cisco Router
      ... I have a Cisco 1720 router that showed telnet open ... ports appear open when scanning at different times. ... deny icmp any timestamp-request ...
      (Security-Basics)
    • RE: Open Ports on Cisco Router
      ... It's a border router with a Fortigate firewall behind ... > access-list 100 deny icmp any host ... Open Ports on Cisco Router ...
      (Security-Basics)
    • Re: 2 pc network - cant see host files from pc 2 on pc 1
      ... Assuming that you have firewall protection via your internet router try ... workgroup because it will be needed for the network to work correctly. ... see if you can access TCP ports 139 and 445 on computer one of which at ... permissions. ...
      (microsoft.public.windowsxp.security_admin)
    • Re: Do I need these services listening?
      ... > first computer that has the modem & router, so I call the second one ... Your Netgear router should connect to the internet. ... Your Netgear router should have the public IP address. ... that if the ports look closed even ...
      (comp.security.firewalls)
    • [VulnWatch] 3Com OfficeConnect Remote 812 ADSL router exposes internal LAN computers ports during ou
      ... ports during outbound and inbound TCP and UDP sessions. ... The 3Com 812 is a widely-deployed router, found in many ISPs ADSL lines. ... for internet access. ...
      (VulnWatch)