Re: udp port 135

[Ralf Spenneberg <lists@spenneberg.org>]

Am Don, 2003-08-14 um 09.54 schrieb cc:
> Rob Sterenborg wrote:
> > 
> > No. I am interested too in why udp shows "open" from a foreign host,
> > while tcp shows filtered.
> > How can I check if an udp port is really closed/filtered or opened ?
> 
> I'm completely stumped on this issue.
There are three possible responses to an udp probe as nmap sends it:

1. Port is closed. OS hopefully sends an ICMP-Port-Unreachable

2. Port is open. Either the application sends an error via UDP or does
not answer at all

3. Port is filtered. No response since the original packet is dropped.

When you compare 2 and 3, you will see that nmap cannot distinguish
between an open and an filtered port. Thus nmap will mark all (drop)
filtered and open ports as open and will recognize only closed and
rejected ports as closed.

Cheers,

Ralf
-- 
Ralf Spenneberg
RHCE, RHCX

Book: Intrusion Detection für Linux Server   http://www.spenneberg.com
IPsec-Howto				     http://www.ipsec-howto.org
Honeynet Project Mirror:                     http://honeynet.spenneberg.org