Re: how nmap can know my firewalled servers ?

Yes, i agree that.
How about UDP, if an udp port firewalled, how does NMAP know it?

2006/4/13, Nathaniel Hall <nathaniel.d.hall@xxxxxxxxx>:
I am assuming you are using a DROP rule on your firewall. NMAP knows
that if it does not receive a response for a TCP connection then it is
firewalled. Dropping traffic at a firewall violates RFC and makes it
much easier to know when there is a firewall between the scanner and the
end host. I recommend using REJECT

-A INPUT -j REJECT --reject-with icmp-host-unreachable

That will conform to RFC (I'm pretty sure) and will make it harder to
detect a firewall with NMAP.

Alexey Eremenko wrote:

Hi all !

I know that "nmap" can show open ports. But nmap also shows my
firewalled ports !
How?

Since some servers (like apache) are firewalled with iptables, how can
nmap know wherever
my system run the service with open port, filtered port or doesn't run
it at all ?


--
Nathaniel Hall, GSEC GCFW GCIA


-------------------------------------------------------------------------
This List Sponsored by: Webroot

Don't leave your confidential company and customer records un-protected.
Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no
obligation. See why so many companies trust Spy Sweeper Enterprise to
eradicate spyware from their networks.
FREE 30-Day Trial of Spy Sweeper Enterprise

http://www.webroot.com/forms/enterprise_lead.php
--------------------------------------------------------------------------




--
http://www.lwang.org
lwang.org provides online base64 encode and decode, crc32 md5 and sha1
hashing, online ciphers, encryption and decryption. We are engaged in
adding more common use lookup service.
We collect spam for research at abryson@xxxxxxxxxxxxx

-------------------------------------------------------------------------
This List Sponsored by: Webroot

Don't leave your confidential company and customer records un-protected.
Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no
obligation. See why so many companies trust Spy Sweeper Enterprise to
eradicate spyware from their networks.
FREE 30-Day Trial of Spy Sweeper Enterprise

http://www.webroot.com/forms/enterprise_lead.php
--------------------------------------------------------------------------

Relevant Pages

  • Re: how nmap can know my firewalled servers ?
    ... UDP or ICMP protocol), it will mark the port as closed. ... descrition, how NMAP determins, if the UDP port is open or closed. ... Try Webroot's Spy Sweeper Enterprisefor 30 days for FREE with no ...
    (Security-Basics)
  • RE: how nmap can know my firewalled servers ?
    ... Thus, say for port 80, it tries to create a connection. ... Depending on how your firewall handles this nmap can figure out that there ...
    (Security-Basics)
  • Re: Tunnelling?
    ... There are several ways to tunnel port 2000 depending on how strict ... "tunneling" to avoid detection of your ... activities or to bypass firewall rules is a serious offense. ... Try Webroot's Spy Sweeper Enterprisefor 30 days for FREE with no ...
    (Security-Basics)
  • RE: firewalk and nmap
    ... Suppose you ran nmap on a machine, and you got "port 25 is filtered". ... completely independent from the firewall. ... If a port with nmap is closed, it surely is not filterd by the FW, ...
    (Pen-Test)
  • Re: Help understanding NMAP results
    ... Went over to a friend's house, and ran an NMAP scan against myself ... you are likely to find your port... ... Do not try to ping hosts at all before scanning them. ... requests through their firewall. ...
    (Security-Basics)