Hi, When I run an nmap with UDP port scan option against one of the machines behind the shorewall, it shows tons of open ports on that server. I am sure I just missed something in the configuration. Can anyone suggest. Val _________________________________________________________________ Join the world’s largest e-mail service with MSN Hotmail. http://www.hotmail.com
On Wed, 15 May 2002, Val Vechnyak wrote:> Hi, > > When I run an nmap with UDP port scan option against one of the machines > behind the shorewall, it shows tons of open ports on that server. I am sure > I just missed something in the configuration. Can anyone suggest. >Yes -- READ THE FAQ!!! -Tom -- Tom Eastep \ Shorewall - iptables made easy AIM: tmeastep \ http://www.shorewall.net ICQ: #60745924 \ teastep@shorewall.net
The UDP protocal only communicates in one direction. Unless your firewall specifically REJECT''s packets, versus DROPing packets silently, nmap doesn''t really know whether the port is really open or closed. Nmap assumes the ports are open, although they may actually be closed. -- Joe Copeland ----- Original Message ----- From: "Val Vechnyak" <vechnyak@hotmail.com> To: <shorewall-users@shorewall.net> Sent: Wednesday, May 15, 2002 10:24 AM Subject: [Shorewall-users] Open UDP ports> Hi, > > When I run an nmap with UDP port scan option against one of the machines > behind the shorewall, it shows tons of open ports on that server. I amsure> I just missed something in the configuration. Can anyone suggest. > > Val > > > > _________________________________________________________________ > Join the world''s largest e-mail service with MSN Hotmail. > http://www.hotmail.com > > _______________________________________________ > Shorewall-users mailing list > Shorewall-users@shorewall.net > http://www.shorewall.net/mailman/listinfo/shorewall-users >
I ran into this same problem and Tom found out that nmap will show open udp ports. You could probably do a search for nmap on the shorewall archived message and find similar postings. I''m using nessus (http://www.nessus.org) to do vulnerability checks and tests against my systems and I personally think it does a better job than nmap. Mike