On Mon, Oct 11, 2004 at 11:48:39AM -0400, Michael Aldrich wrote: > Hi, > I am running 0.9 version of firewall on RedHat 7.3 (2.4.24). When I run a > scan from another machine (nmap -sU XXX.XXX.XXX.XXX where X is my external > IP), just about every port from 1/udp to 54321/udp is listed as open.
The reason you see them reported as OPEN is that the firewall script uses a DENY target to silently discard authorized packets. Since nmap sees no response to it's port queries it assumes that they are open. -sU UDP scans: This method is used to determine which UDP (User Datagram Protocol, RFC 768) ports are open on a host. The technique is to send 0 byte udp packets to each port on the target machine. If we receive an ICMP port unreachable message, then the port is closed. Otherwise we assume it is open. I believe newer versions of nmap may do a better job of correctly reporting the state of UDP ports but takes considerably longer to run. -sU UDP scans: This method is used to determine which UDP (User Datagram Protocol, RFC 768) ports are open on a host. The tech- nique is to send 0 byte UDP packets to each port on the target machine. If we receive an ICMP port unreachable message, then the port is closed. If a UDP response is received to the probe (unusual), the port is open. If we get no response at all, the state is "open|filtered", meaning that the port is either open or packet filters are blocking the communication. Versions scan (-sV) can be used to help differentiate the truly open ports from the filtered ones. (The 1467 ports scanned but not shown below are in state: closed) PORT STATE SERVICE 9/udp open|filtered discard 53/udp open|filtered domain 67/udp open|filtered dhcpserver 123/udp open|filtered ntp 161/udp open|filtered snmp 162/udp open|filtered snmptrap 500/udp open|filtered isakmp 3130/udp open|filtered squid-ipc 3401/udp open|filtered squid-snmp 5000/udp open|filtered UPnP 10080/udp open|filtered amanda Nmap run completed -- 1 IP address (1 host up) scanned in 1471.445 seconds -- Jamin W. Collins This is the typical unix way of doing things: you string together lots of very specific tools to accomplish larger tasks. -- Vineet Kumar