Open Ports

[NVETHIS]

Is there a website I can go to to have it test what ports are open on my server and accepting incoming connections?

-Bryan

 

[n0cmonkey]

grc.com's shields up.. But ignore the idiotic ranting about stealthing ports.

 

[yelo333]

n0cmonkey - what makes you say that? Considering most of the ways script kiddies find you now is via ping sweeps...stealth sounds like a good idea to me.

 

[n0cmonkey]

Originally posted by: yelo333
n0cmonkey - what makes you say that? Considering most of the ways script kiddies find you now is via ping sweeps...stealth sounds like a good idea to me.

Some ICMP is good, and it's still trivial to find out if someone is online or not. If the machine was not there, the router should send back errors.

EDIT: Send back errors, as opposed to silently dropping the traffic into the void.

 

[yelo333]

Originally posted by: n0cmonkey

Originally posted by: yelo333
n0cmonkey - what makes you say that? Considering most of the ways script kiddies find you now is via ping sweeps...stealth sounds like a good idea to me.

Some ICMP is good, and it's still trivial to find out if someone is online or not. If the machine was not there, the router should send back errors.

EDIT: Send back errors, as opposed to silently dropping the traffic into the void.

I've seen it articulated like that before, but never stopped to think about it long enough. Still, stealthed seems like a better alternative to closed, as now, it still gives less then a "I'm alive and well, I'm a windoze box, and open for attack, hit me!".

 

[n0cmonkey]

Originally posted by: yelo333

Originally posted by: n0cmonkey

Originally posted by: yelo333
n0cmonkey - what makes you say that? Considering most of the ways script kiddies find you now is via ping sweeps...stealth sounds like a good idea to me.

Some ICMP is good, and it's still trivial to find out if someone is online or not. If the machine was not there, the router should send back errors.

EDIT: Send back errors, as opposed to silently dropping the traffic into the void.

I've seen it articulated like that before, but never stopped to think about it long enough. Still, stealthed seems like a better alternative to closed, as now, it still gives less then a "I'm alive and well, I'm a windoze box, and open for attack, hit me!".

We know that pings are unreliable these days, so we don't rely on them exactly. Try a TCP connection to an IP address. If a RST is returned, there is a host there and the port is closed. If a host unreachable(?) is sent back, then there is no host there. If nothing happens, there's probably a host and the host is dropping the packets silently.

Showing the ports as closed tells someone that you're actually using a firewall, so they might as well move on to an easier target.