GRC Nanoprobe Failure

Discussion in 'other security issues & news' started by eyespy, May 14, 2003.

Thread Status:
Not open for further replies.
  1. eyespy

    eyespy Registered Member

    Joined:
    Feb 20, 2002
    Posts:
    490
    Location:
    Oh Canada !!
    Hi all !
    When checking and testing my ports at GRC, I always passed while using ZAP.
    I've just recently set up a D-Link router which works fine.
    Now when I do a portscan at GRC "solicited TCP packets" and "ping reply" fail.
    Now is this a serious issue ? If so, what can I do to fix it ?
    Obviously this is related to the router. I didn't receive one alert from ZAP while the portscans were taking place.

    I'll include a copy of the GRC report.

    Thanks and regards,
    bill
     

    Attached Files:

  2. Patrice

    Patrice Registered Member

    Joined:
    Apr 15, 2003
    Posts:
    571
    Location:
    Antarctica
    Hi eyespy,

    it's not ZA anymore which is tested but your D-Link router. Do you have a new one? Otherwise try to install the latest firmware available for your router. Normally that helps. If it doesn't work out for you, contact the support of D-Link and let 'em know your results.

    Best regards,

    Patrice
     
  3. eyespy

    eyespy Registered Member

    Joined:
    Feb 20, 2002
    Posts:
    490
    Location:
    Oh Canada !!
    Patrice,
    I hate to "Flash" it so soon !! :p It is working great. The "ping return" is not a big concern but I'm a little concerned about the "solicited TCP packets".
    I will try the D-Link website. Thanks


    regards,
    bill ;)
     
  4. CrazyM

    CrazyM Firewall Expert

    Joined:
    Feb 9, 2002
    Posts:
    2,428
    Location:
    BC, Canada
    Hi Bill

    From the posted log it shows a closed response for service/port 113 (auth/ident). If you require your system to respond closed on this local service/port for any email or ftp, then you may want to leave it as is.

    If you do not require this closed response and want to stealth it, I believe with the DLink it is done by forwarding the port to a Virtual Server - in this case a non existent IP on the LAN. Try looking under the Advanced settings for Virtual Server set up.

    Take a look under Tools - Misc for the echo request/echo reply settings.

    Regards,

    CrazyM
     
  5. eyespy

    eyespy Registered Member

    Joined:
    Feb 20, 2002
    Posts:
    490
    Location:
    Oh Canada !!
    CrazyM,
    I didn't install the Router software, didn't feel that I needed it since I'm also using ZAP.
    Do you think the "ping return" and the "solicited TCP packets" are a serious security threat ? :eek:

    thanks,
    bill ;)
     
  6. CrazyM

    CrazyM Firewall Expert

    Joined:
    Feb 9, 2002
    Posts:
    2,428
    Location:
    BC, Canada
    Hi Bill

    The ping return and closed response are not a security threat, but if you want your public IP to be stealth you should be able to accomplish that by configuring the router/gateway.

    You do not need to install their software, that is usually just a wizard to help with network set-up on your system.

    You should be able to access the configuration pages/options via a web based interface with the router/gateway. Just use your browser and try http://192.168.1.1 or whatever the router/gateway is using as it's address.

    Regards,

    CrazyM
     
  7. Patrice

    Patrice Registered Member

    Joined:
    Apr 15, 2003
    Posts:
    571
    Location:
    Antarctica
    Hi CrazyM,

    I didn't see the attached log... :oops:

    Sounds interesting to me, what you suggest. I have a question concerning this, I'm using myself a router as well (Linksys BEFSR41). If I hide port 113, don't I have other problems by surfing around? This service is needed from special sites and as you said FTP and Email. Should I try this out to see if it works? ;)

    Thanks in advance!

    Best regards,

    Patrice
     
  8. eyespy

    eyespy Registered Member

    Joined:
    Feb 20, 2002
    Posts:
    490
    Location:
    Oh Canada !!
    Patrice,
    good question ! I was wondering that very same thing !

    regards,
    bill :)
     
  9. Patrice

    Patrice Registered Member

    Joined:
    Apr 15, 2003
    Posts:
    571
    Location:
    Antarctica
    Hello people,

    GREAT, I just did what CrazyM mentioned and this is working fine! I just forwarded port 113 to an IP which doesn't exist in my network. Since then my port 113 is stealth again! :D

    What a nice, dirty trick CrazyM! :D

    I owe you a beer or two! ;)

    Best regards,

    Patrice
     
  10. eyespy

    eyespy Registered Member

    Joined:
    Feb 20, 2002
    Posts:
    490
    Location:
    Oh Canada !!
    OK...
    I got it figured out. 113 is stealthed and no response to pings ! I'll try it for a few days and report any problems.

    Ty CrazyM and Patrice ;)

    regards,
    bill :)
     
  11. CrazyM

    CrazyM Firewall Expert

    Joined:
    Feb 9, 2002
    Posts:
    2,428
    Location:
    BC, Canada
    Hi Bill

    Good to hear you got it sorted out. Be sure to check all the default settings in the configuration pages to make sure you are happy with them. ie. change default password, remote management are a couple to check.

    Regards,

    CrazyM
     
  12. CrazyM

    CrazyM Firewall Expert

    Joined:
    Feb 9, 2002
    Posts:
    2,428
    Location:
    BC, Canada
    Hi Patrice

    I have not kept up with the firmware releases for the BEFSR41 and how the different releases responded to scans (unfortunately it did vary between releases).

    If you have a particular local service/port that continually responds closed on your router/gateway and if you want stealth, forwarding that port to a non-existant internal IP (or in Bill's case what DLink referes to as Virtural Server), is one way to have those packets dropped and achieve a stealth response. You just have to be careful in choosing the IP used and make sure it is not one that the router/gateway will use in it's assignment of IP's via the DHCP server. This technique for the Linksys was touched on by Pilli in this post with comments to be aware when doing this by myself.

    Regards,

    CrazyM
     
  13. eyespy

    eyespy Registered Member

    Joined:
    Feb 20, 2002
    Posts:
    490
    Location:
    Oh Canada !!
     
  14. Patrice

    Patrice Registered Member

    Joined:
    Apr 15, 2003
    Posts:
    571
    Location:
    Antarctica
    Hi eyespy,

    should work if I look at your settings. What are the results of the online test (GRC) now?

    Regards,

    Patrice
     
  15. CrazyM

    CrazyM Firewall Expert

    Joined:
    Feb 9, 2002
    Posts:
    2,428
    Location:
    BC, Canada
    Hi Bill

    If your system IP (192.168.0.100) is assigned automatically by the routers DHCP server that would suggest to me that it starts at .100 and goes up from there. In that case using 192.168.0.10 for the virtual server should be OK.

    As I mentioned to Patrice in an earlier post: "You just have to be careful in choosing the IP used and make sure it is not one that the router/gateway will use in it's assignment of IP's via the DHCP server."

    Is there a configuration page for the DLink's DHCP server that confirms the default range of IP's used?

    Regards,

    CrazyM
     
  16. eyespy

    eyespy Registered Member

    Joined:
    Feb 20, 2002
    Posts:
    490
    Location:
    Oh Canada !!
    Hi Patrice !
    Port 113 now shows stealth and no "pings" returned. :)

    regards,
    bill ;)
     
  17. eyespy

    eyespy Registered Member

    Joined:
    Feb 20, 2002
    Posts:
    490
    Location:
    Oh Canada !!
    Thanks CrazyM !
    In the D-Link wizard, under "Status", in the WAN section, DNS is 192.168.1.10 192.168.1.34 exactly.

    I have Ident on port 113 set to Virtual Server 192.168.0.10

    Everything seems to working fine at this point !! ;)

    thanks and regards,
    bill :)
     
Loading...
Thread Status:
Not open for further replies.