[ale] Nmap + filtered ports

[James P. Kinney III]

On Thu, 2005-12-15 at 21:46 -0500, Bob Toxen wrote:
> First, as noted previously, -j REJECT sends a packet back that nmap sees;
> use DROP (or DENY if using Chains).
> 
> Second, generally it's best just to DROP all that you don't allow rather
> than trying to get "clever".  You probably don't know enough about networking
> to outsmart nmap or other very clever scanners and thus just will "tip your
> hand".

Good point.

I'm working on a hack to iptables that allows a 
-j REJECT --reject-with BillRulz

Seems like a fun waste of time. or better
 --reject-with forwarded-address-to-FBI
> 
> Bob Toxen
> bob at verysecurelinux.com               [Please use for email to me]
> http://www.verysecurelinux.com        [Network&Linux/Unix security consulting]
> http://www.realworldlinuxsecurity.com [My book:"Real World Linux Security 2/e"]
> Quality Linux & UNIX security and SysAdmin & software consulting since 1990.
> 
> "Microsoft: Unsafe at any clock speed!"
>    -- Bob Toxen 10/03/2002
> 
> On Wed, Dec 07, 2005 at 04:54:36PM -0500, James P. Kinney III wrote:
> > On Wed, 2005-12-07 at 16:43 -0500, Christopher Fowler wrote:
> > > Can someone tell me how nmap sees "filtered" ports?  I've got my rule se
> > > to reject and nmap can see that something is there but it is being
> > > rejected.  I thought "REJECT" would appear as if there was no one bind
> > > ()'ing on that port?
> > > 
> > > 
> > -j REJECT --reject-with icmp-host-prohibited
> > 
> > Shows on a nmap scan as "closed"
> > > _______________________________________________
> > > Ale mailing list
> > > Ale at ale.org
> > > http://www.ale.org/mailman/listinfo/ale
> > -- 
> > James P. Kinney III          \Changing the mobile computing world/
> > CEO & Director of Engineering \          one Linux user         /
> > Local Net Solutions,LLC        \           at a time.          /
> > 770-493-8244                    \.___________________________./
> > http://www.localnetsolutions.com
> > 
> > GPG ID: 829C6CA7 James P. Kinney III (M.S. Physics)
> > <jkinney at localnetsolutions.com>
> > Fingerprint = 3C9E 6366 54FC A3FE BA4D 0659 6190 ADC3 829C 6CA7
> 
> 
> 
> > _______________________________________________
> > Ale mailing list
> > Ale at ale.org
> > http://www.ale.org/mailman/listinfo/ale
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale
-- 
James P. Kinney III          \Changing the mobile computing world/
CEO & Director of Engineering \          one Linux user         /
Local Net Solutions,LLC        \           at a time.          /
770-493-8244                    \.___________________________./
http://www.localnetsolutions.com

GPG ID: 829C6CA7 James P. Kinney III (M.S. Physics)
<jkinney at localnetsolutions.com>
Fingerprint = 3C9E 6366 54FC A3FE BA4D 0659 6190 ADC3 829C 6CA7
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part