Explaination of network scan ports.

NuxIT · 06-15-2006, 10:19 AM

I was scanning my network using shields up with my linux box both behind firewall and then on DMZ. The first scan showed all ports stealth except port: 68 bootstrap protocol which was blue(closed). When scanning the machine in DMZ mode it shows this port Red (open). Any ideas on this one? Thanks

Code:

root@nuxbox:/etc# netstat -tupan
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:68              0.0.0.0:*               LISTEN     2393/pump 
tcp        0      0 10.16.0.52:68           4.79.142.206:57170      SYN_RECV   -

osor · 06-17-2006, 10:21 AM

Your firewall is not configured correctly. It should have the DHCP port open only for a specific DHCP server (your ISP's). Also, your DMZ machine might be misconfigured. It should have that port open only for a specific machine.

Instead of netstat, can you post your iptables firewall rules (for both the firewall and DMZ)?