Archived from groups: comp.security.firewalls (More info?)

I have two offices using the same Linksys router, and both are showing
open UDP ports when doing a port scan from outside using AATools port
scan module. The router is the Linksys BEFSX41. I have a few open TCP
ports that I manually configured in port forwarding, but the UDP ports I
see open are a mystery to me. The following UDP ports show open when
using AATools, 389, 6838, 9325, 10067, 10167, 10666, 12623, 18753,
20433, 26274, 27444, 31789, 31791, 34555, 35555, & 47262. I am under the
assumption that only the ports that I forward are the only ports I
should see open, so I have to assume that the router/firewall is not
doing it's job properly. I understand that if a program opens the ports
for data to come back in, it will show these ports as open, but I can't
find anything running on the local PCs that would be opening these
ports. I also assumed that the firewall in these Linksys devices are
suppose to block everything and only allow what you forward. Any help on
this matter would be greatly appreciated.

Frank
Clyde Development Corp.

Archived from groups: comp.security.firewalls (More info?)

Frank [GOD] <easyREMOVEnews@frankbaris.com> wrote:
> I have two offices using the same Linksys router, and both are showing
> open UDP ports when doing a port scan from outside using AATools port
> scan module.

What exactly is this AATools thing doing? UDP scanning has it's pitfalls,
see: http://www.insecure.org/nmap/nmap_ [...] rt_unreach

Perhaps AATools is showing wrong information here.

Yours,
VB.
--
"Es kann nicht sein, dass die Frustrierten in Rom bestimmen, was in
deutschen Schlafzimmern passiert".
Harald Schmidt zum "Weltjugendtag"

Archived from groups: comp.security.firewalls (More info?)

"Frank [GOD]" <easyREMOVEnews@frankbaris.com> wrote in message
news:gLiWe.20340$R83.2331@fe04.news.easynews.com...
>I have two offices using the same Linksys router, and both are showing open
>UDP ports when doing a port scan from outside using AATools port scan
>module. The router is the Linksys BEFSX41. I have a few open TCP ports that
>I manually configured in port forwarding, but the UDP ports I see open are
>a mystery to me. The following UDP ports show open when using AATools, 389,
>6838, 9325, 10067, 10167, 10666, 12623, 18753, 20433, 26274, 27444, 31789,
>31791, 34555, 35555, & 47262. I am under the assumption that only the ports
>that I forward are the only ports I should see open, so I have to assume
>that the router/firewall is not doing it's job properly. I understand that
>if a program opens the ports for data to come back in, it will show these
>ports as open, but I can't find anything running on the local PCs that
>would be opening these ports. I also assumed that the firewall in these
>Linksys devices are suppose to block everything and only allow what you
>forward. Any help on this matter would be greatly appreciated.
>

It would be interesting to see if that software is lying to you by using
something like Wallatcher for the BEF model router and review the syslogs to
see if the traffic is being blocked.

http://www.sonic.net/wallwatcher/#Routers

The I-RED means blocked. You can use the Help menu to determine the code
meanings.

Duane





..

Archived from groups: comp.security.firewalls (More info?)

Frank [GOD] wrote:

> I have two offices using the same Linksys router, and both are showing
> open UDP ports when doing a port scan from outside using AATools port
> scan module. The router is the Linksys BEFSX41. I have a few open TCP
> ports that I manually configured in port forwarding, but the UDP ports I
> see open are a mystery to me. The following UDP ports show open when
> using AATools, 389, 6838, 9325, 10067, 10167, 10666, 12623, 18753,
> 20433, 26274, 27444, 31789, 31791, 34555, 35555, & 47262. I am under the
> assumption that only the ports that I forward are the only ports I
> should see open, so I have to assume that the router/firewall is not
> doing it's job properly. I understand that if a program opens the ports
> for data to come back in, it will show these ports as open, but I can't
> find anything running on the local PCs that would be opening these
> ports. I also assumed that the firewall in these Linksys devices are
> suppose to block everything and only allow what you forward. Any help on
> this matter would be greatly appreciated.
>
> Frank
> Clyde Development Corp.

Is UPnP enabled?
E.