Houston, we have a problem...

I have the same features on my router except I use a wireless
ISP. In the Web interface Router setup there is an option called
DMZ (Demiliterized Zone)
This option will enable ONE intranet computer to be exposed to the internet, "Honey Pot"
Zero is Off and One is On...
If you want to the send file option with this router, You need to
make a special setting also.
You can enable incomming and outgoing access Logs which you send to whatever Intranet IP you chose. Default is 192.168.1.255
In the advanced config the defaults are
Block WAN request = enable
IPSec Passthru =enable
PPTP Passthru =enable
Remote Managment =Disable
Remote Upgrade =Disable

am I rattling again Spy 1? LOL

 

Yes, of course, but please wait, as I have the router out of the line-up. I'll post here again in a few minutes...

Thanks very much!
Hilly.

 

Yes, please fire away. May I reciprocate with TDS-3's interrogate scan? I'll need your IP address.


Hilly.

 

Unicron - Get on ICQ with him if you haven't already, okay? PM'ing you his temporary ICQ #.

controler - Let me know if you want his ICQ # , okay? Pete

(Pete's an interested quad at an olympic ping-pong match! ).

 

I don't use ICQ, I'll have to make an account. Give a bit to do that.

Pawthentic, I PM'd you an IP to test back with, and some nmap results.

 

Also for UNICRON ~~

If you would be so kind, could you use TDS-3 on my IP address?

Hilly.

 

I am running Linux right now. No TDS install. I could install the dem o on a windows box that belongs to a freind that is in for repairs perhaps.

 

No, that won't be necessary. The entire issue here, with me, is the fact that I consistently get bogus results when using TDS-3 behind a router, and today in testing with Spy1 I even got strange results (ports open/services running) without the router in line.

Did you run NMAP against me?

Regards,
Hilly.

 

The only light shed is a dark one. Foundstone's SuperScan port scanner shows none of the open ports I see when scanning Spy1's IP address with TDS-3.

TDS-3 still shows bogus results for me, when running the regular TCP scanner against Spy1's IP address. This time, I wasn't behind the router.

Well, since we're all running in circles here (at least I know _I'm_ running in circles) ~~ I'll be down for a few hours while I completely wipe clean and reinstall my XP box.

I'll be back, we'll see if I'm still screwed or not.

Thank you to all here who helped me today.

Wayne, you're still punished, and I'm adding 1 month to the amount of time that you're grounded. Now GO TO YOUR ROOM!

Hilly.

 

Hilly - it's possible that the out-of-the-ordinary results without the router were due to the fact that I was running Jammer 1.95 as well as TDS-3 at the time. Just thought I'd let you know.
Pete

 

Hi again, Pete.

For discussion purposes only, let's (for a moment) not talk about any remote scanning of me, or done by me. Let's talk about my LAN. ~~~~

Box#1 - WinXP, less than a month old, bi-daily full scans with TDS-3 and NAV, both fully updated.

Box#2 - WinME, squeaky-clean install, no 3rd party apps. Fully updated.

Box#3 - Win2k pro, squeaky-clean install, no 3rd party apps, no IIS, no services enabled. SP2 done and fully updated.

Linksys BEFSR-41 used as gateway to cable modem. 4-port 10/100 switch built-in to Linky handles networking.

All 3 machines trade ICMP without a problem. File/printer sharing is disabled all the way around.

Netstat run on all 3 boxes shows nothing out-of-the-ordinary.

TDS-3 on the XP box reports incorrectly that many common ports are open and listening on both the winME and win2k boxes.

Right now, I've got the fresh winME box connected to the LAN. Here's the netstat dump from it:
------
TCP 192.168.1.100:139 0.0.0.0:0 LISTENING
UDP 192.168.1.100:137 *:*
UDP 192.168.1.100:138 *:*
------

...and here's TDS-3's log from an Interrogate scan run minutes ago:
------
01:49:10 [Init] Trojan Defence Suite v3.2.0 - Registered to Hilly Waldman
01:49:10 [Init] Started 07-07-02 01:49:10 Eastern Standard Time (UTC: 5), Internet Time @284.14
01:49:10 [Init] Loading TDS-3 Systems ...
01:49:10 [Init] • Plugins : OK. Loaded 13
01:49:10 [Init] • Exec Protection : Not Installed
01:49:10 [Init] Loading Radius Advanced Scanning Systems ... <R3 Engine, DCS Labs>
01:49:14 [Init] • Radius Advanced Specialist Extensions on standby for 13 trojan families
01:49:14 [Init] • Systems Initialised [15043 references - 4746 primaries/3429 traces/6868 variants/other]
01:49:14 [Init] Radius Systems loaded. <Databases updated 04-07-2002>
01:49:14 [Init] TDS-3 Ready. <Hilly@192.168.1.101, 127.0.0.1 - United States>
01:49:14 [Tip Of The Day] The Target Host menu is dedicated to finding out information about remote computers, from backdoors to system information to network positioning.
01:49:14 [TDS] Good morning Hilly. What are you doing up at this time?
01:49:16 [Memory Scan] Memory scan started, please wait a moment ...
01:49:17 [Memory Scan] Memory scan complete.
01:49:17 [Mutex Memory Scan] Started...
01:49:18 [Mutex Memory Scan] Finished (no trojan mutexes found).
01:49:18 [Trace Scan] Started...
01:49:21 [Trace Scan] Finished.
01:49:53 [Interrogate] Interrogation scan on 192.168.1.101 started.
01:49:53 [Interrogate] 192.168.1.101:25: Connected
01:49:54 [Interrogate] 192.168.1.101:135: Connected
01:49:54 [Interrogate] 192.168.1.101:110: Connected
01:49:54 [Interrogate] 192.168.1.101:80: Connected
01:49:54 [Interrogate] 192.168.1.101:80: Connected
01:49:55 [Interrogate] 192.168.1.101:1080: Connected
01:49:55 [Interrogate] 192.168.1.101:139: Connected
01:49:55 [Interrogate] 192.168.1.101:139: Connected
01:49:55 [Interrogate] 192.168.1.101:2: Closed - connection closed immediately.
01:49:56 [Interrogate] 192.168.1.101:135: Closed - remained silent.
01:49:56 [Interrogate] 192.168.1.101:6: Closed - connection closed immediately.
01:50:10 [Interrogate] 192.168.1.101:83: Connected
01:50:10 [Interrogate] 192.168.1.101:82: Connected
01:50:10 [Interrogate] 192.168.1.101:81: Connected
01:50:11 [Interrogate] 192.168.1.101:88: Closed - connection closed immediately.
01:50:11 [Interrogate] 192.168.1.101:88: Closed - connection closed immediately.
01:50:11 [Interrogate] 192.168.1.101:88: Closed - connection closed immediately.
01:50:25 [Interrogate] 192.168.1.101:139: Closed - Error (Connection is aborted due to timeout or other failure)
01:50:31 [Interrogate] Interrogation of 192.168.1.101 finished.
------

Now, does this look like incorrect results? Am I not reading the console log properly? Should TDS-3 be showing as 'connected' to all of those common ports?

Correct me if I'm wrong, but my router's WAN side doesn't even come into the picture here, as all of this is taking place on my LAN.

If I'm really that stupid, and I don't know what I'm seeing, then why is it so hard for me to get a qualified answer?

Now, if we want to discuss -remote- scanning done by me, and done to me, then that may or may not be a different issue. FWIW I can get the same results, showing the same common ports as open when I scan just about anyone else. You personally saw my scans of you today, and they also reported you were open and listening on many common ports that would indicate you're running services like HTTP, SMTP, POP3, etc. While you may have TDS-3 set to initialize sockets, I'd bet you don't have it set-up to listen on those common ports, but in fact are listening on trojan ports.

There is definitely something wacky going on here, and although it may be my fault or ignorance, the fact that I can't get any help from DCS sure does disappoint me.

Regards, Pete.
Hilly.

 

Hi Paul. Thanks for the reply, and nice to talk to you again.

Nobody expects to have instant access to 7-day/24hour support, least of all me.

I've already been in contact with DCS, and I really wasn't too happy with what I was told. I outright admitted that whatever problem I was seeing was possibly (probably) my fault. Here, read for yourself. This is a portion of the last e-mail I sent Wayne, on June 28th:
------
Wayne wrote:
[]
> but questions relating to sockets and routers should be
> directed somewhere more appropriate, not an anti-trojan
> company.

But my question is about TDS-3, and why I'm seeing such strange scan
results. I totally agree (and understand) that this is most likely
something on my end.

* Quick questions: *
1. Are you aware of any issues when running TDS-3 behind a router?
2. Is TDS-3's operation behind a router covered anywhere in the TDS-3
documentation?
3. Have any other TDS-3 users asked about running behind a router?
4. Do you agree that what I'm seeing, and what Jim sees when scanning me,
is abnormal?
5. Should I never use the word 'router' when e-mailing you? <g>

Please note Jim Martin's reply to me in the forum.

http://www.dcsresearch.com/forum/showthread.php?s=91c3a4923e6445c827b75826a1
835688&threadid=1043

He is runing win2k sp2 and his scan of me, while I was behind a router, is
way, way off. I promise I'm not running any services like HTTP, NNTP, POP,
SMTP, etc. I would see practically the same results when scanning remote
addresses from winxp pro. Again, I'm not saying it's TDS-3's fault, but if
running scans from behind a router is something I need to learn about before
I can use TDS-3 effectively, then why isn't it covered in the documentation?
------

I haven't heard anything back from him yet, and today makes 9 days since I last e-mailed him.

I can only guess that my questons are so incredibly stupid that Wayne and Gavin are too busy laughing to reply with some helpful information. Of course, the TDS-4 carrot-on-a-stick-hanging-in-fromt-of-our-noses is probably keeping them busy, too ~~ but too busy to help a paying customer, especially since my questions are directly related to TDS-3? I'm left here asking myself what the heck I did wrong, and why won't DCS help with this?

Please don't misunderstand me, I will use and defend TDS-3 (and DCS) forever. I'm convinced that they're good guys, and make a fine product. In the past, I've stood by them while they were being virtually attacked on the newsgroups at GRC. I'm always telling people how great TDS-3 is, and how wonderful the support for it is. Excuse me while I go put on my dunce-cap.

Can you imagine my embarrasment when being confronted by numerous people, all saying that I can't possibly be getting valid results from TDS-3 after scanning them and finding the same open ports, then reporting that to them? I finally realized that I was seeing the same results being reported, so I did some testing on my LAN, where I saw again, the same results reported... but on my LAN I can run netstat on the other (scanned) boxes. That's when I started getting upset. Netstat on fresh boxes with no 3rd party apps says no, TDS-3 says yes, who do I believe?

Well, anyway, thanks again for the reply.

Best Regards, Paul.
Hilly.

 

I prolly should have got out of this discussion along time ago
But Paw even though it is early again this morn,
I look at your last post and to me it reads
You did a netstat on the Win Me box, you then did a scan of that
Win Me box with your Win XP box and TDS-3 which are both connected to the router. Your Win ME box is using ending 101 as the Lan IP and your XP is using ending 100 IP. You say you have no third partry software
on your ME machine. Why would you not have open ports on your ME machine?

 

No, you shouldn't have. You were the first to reply to me in this thread, and if what is being said here has you interested or curious, then you have every right to read, reply, and offer input. I greatly appreciate all comments.

For a port to be open, which means that it is listening for incoming connection requests, there has to be something holding it open. A fresh install of winME has nothing to hold ports open, besides what is shown in the netstat dump that I posted. If, for example, I were to install Apache (a popular web-server), then my netstat would show TCP port 80 as open, listening for incoming connection requests.

If you were to run TDS-3's Interrogate scan (or any other, for that matter) and saw a 'connection' on port 25, then that would indicate that I was either running a mail server (SMTP) or had some other program holding that port (25) open, listening for incoming connection requests.

This morning, someone over in the DCS forums (who is running behind a Linksys router) ran both TDS-3's Interrogate scan and NMAP against my IP address. The results he got with TDS-3 were incorrect, but NMAP correctly reported that all scanned ports were filtered. So, here I am saying that not only is TDS-3 mis-reporting scans on my LAN, but also that others using TDS-3 to scan my IP address remotely are also seeing incorrect results. Please note that my router may or may not have anything to do with this. At this point I'm still not sure of just what is going on, but I feel REALLY CONFIDENT that there's someing wrong.

Is it me? Fine, great, I can deal with that. Just let someone tell me what I'm doing wrong. Let someone who knows come here and say "Hey you dummy, read the frigging manual! It's right there."

Is it my router? Fine also. Let someone tell me that, then explain to me why nobody warned me that TDS-3 won't work properly behind a router. I really don't care if some functions of TDS-3 can't be used if I'm behind a router, but TELL ME. What about the other TDS-3 users who are behind (Linksys?) routers? Don't they have the right to know, and shouldn't we ALL have been informed of this?

I can just see it now... "Dear Hilly, blah blah blah router. Blah blah blah TDS-3. By the way, all licensed TDS-3 users will receive a free upgrade to TDS-4, and a substancial discount on TDS-4 Scanner and TDS-4 ActiveGuard." (hi Wayne!)

Of course, if I'm wrong, then all of this could have been avoided by some e-mail from DCS; which, by the way, it's now been 10 days since I last e-mailed them.

Regards, controler,
Hilly.

 

I was confused again

I thought you were only showing ports open when you went
between your lan connected computers and not when comming in from the outside through your Cable modem but since others are getting wierd reading after scanning your IP with TDS then I am still confused. When I scanned your IP I didn't see anything unusual
and I am running the same router. I was wishing you had a spare router to verify it is NOT the router. If you lived close, Heck You could borrow my router. Some ISP's are not even installing routers on cable
for home users and that's not good. It is just wierd you are showing open ports from the outside and inside and not when taking out router. Makes me wonder if router isn't bad.
I wish you the best of luck in getting this figured out.

 

Controler, would you please post the part of your TDS-3 log that shows the results of your scanning me? If you weren't aware, the log can be read (and copied to clipboard) by going to the top of the TDS-3 console, left-click on 'TDS', then left-click on 'View Logfile', then select this month (July), then select today's date (the 7th). Highlight the portion you want to copy, then right-click on it and select 'Copy'. Finally, reply to this post and in your reply right-click and select 'Paste'.

Apologies if I'm giving you instructions for something you already know how to do.

Thanks very much, Controler.

Regards,
Hilly.

 

I am not sure if this is normal for the trial version which I have
but the scan was not saved and the tracert was.
I can try it again and see if it saves it. I know there is a bunch of this dissabled in the trial version.

 

Here is what I just got with the targeted port scanner

110: Remained silent.
25: Remained silent.
21: Remained silent.

 

Hi Controler.

I'm not sure if logging is disabled in the trial version, but I can't imagine that it would be.

The only thing that get logged this way are scans that show-up in the console (main window). If you run any scans that open seperate windows then they don't get placed in the log... at least that's what I'm seeing over here.

The Interrogate plug-in runs in the main window, is that the scan that you ran?

Thanks again,
Hilly.

 

yep I do get logs but the remote scan log was not saved for some reason. Is there another scan I should be trying?

 

The 'remote scan' wasn't saved because (I'm guessing) it spawns a seperate window. I'm seeing here (on my end) that nothing in any window aside from the main window (console) gets logged. Heck, I've seen one TDS-3 scan that takes place in a non-resizable window with no scroll-bar, so there's no scrolling-up to see all the results -and- it doesn't get logged. Oh, well... another feature request for TDS-4?

Try the Interrogate scan. It's under 'Plugins' on the top of the main TDS-3 window. Make sure my IP address is in the 'Target Host' box. It's still 24.58.230.189

Regards,
Hilly.

 

This is the first time I used the interrogate from plugins

11:52:18 [Interrogate] Interrogation scan on 24.58.230.189 started.
11:52:18 [Interrogate] 24.58.230.189 :21: Connected
11:52:18 [Interrogate] 24.58.230.189 :25: Connected
11:52:39 [Interrogate] 24.58.230.189 :135: Closed - connection closed immediately.
11:52:39 [Interrogate] 24.58.230.189 :135: Closed - connection closed immediately.
11:52:39 [Interrogate] 24.58.230.189 :135: Closed - connection closed immediately.
11:53:00 [Interrogate] 24.58.230.189 :3: Closed - connection closed immediately.

 

Hi Pawthentic! Hope you don't mind but I did an Interrogate Scan with my TDS-3 too. I would have replied sooner but I had some trouble with my png files. Ah, b**ger the png files! Here's the info. (Should have done it by hand, anyway. Sigh.)

11:32:47 [Interrogate] 24.58.230.189:1025: Connected
11:33:32 [Interrogate] 24.58.230.189:1025: Connected
11:34:17 [Interrogate] 24.58.230.189:1: Closed - connection closed immediately.

Then I waited about 5 minutes and got nothing more. Hope it helps. (Noticed LOTS of inquiries by your IP on my Firewall Log! Want a copy?) Should of told you first, I guess. Apologies.

 

I sure am getting a whole bunch of incoming over here.

I'm not sure who it is, and I'll modify the addresses to protect thos who don't want their IP address posted, but whoever has this address: xxx.xxx.71.174 ~~ I have a queston for you.

Keeping in mind that I'm here saying that TDS-3 is not giving me correct scan results, here is the log from MY running the Interrogate plugin on your IP address (xxx.xxx.71.174)...

------
12:41:34 [Interrogate] Interrogation scan on xxx.xxx.71.174 started.
12:41:34 [Interrogate] xxx.xxx.71.174:25: Connected
12:41:55 [Interrogate] xxx.xxx.71.174:110: Connected
12:41:55 [Interrogate] xxx.xxx.71.174:80: Connected
12:41:55 [Interrogate] xxx.xxx.71.174:135: Closed - connection closed immediately.
12:42:16 [Interrogate] xxx.xxx.71.174:1080: Connected
12:42:16 [Interrogate] xxx.xxx.71.174:1080: Connected
12:42:16 [Interrogate] xxx.xxx.71.174:3: Closed - connection closed immediately.
12:42:18 [Interrogate] xxx.xxx.71.174:1080: Closed - remained silent.
12:44:45 [Interrogate] xxx.xxx.71.174:53: Connected
12:44:47 [Interrogate] xxx.xxx.71.174:53: Closed - remained silent.
12:46:28 [Interrogate] xxx.xxx.71.174:82: Connected
12:46:28 [Interrogate] xxx.xxx.71.174:81: Connected
12:46:28 [Interrogate] xxx.xxx.71.174:83: Connected
12:46:28 [Interrogate] xxx.xxx.71.174:85: Closed - connection closed immediately.
12:46:49 [Interrogate] xxx.xxx.71.174:89: Closed - connection closed immediately.
12:46:49 [Interrogate] xxx.xxx.71.174:90: Closed - connection closed immediately.
12:53:07 [Interrogate] Interrogation of xxx.xxx.71.174 finished.
------

Now, my question is this ~~~~ If I e-mailed you, and said that you SEEM to be running services. If I said that I'm using the best trojan-killer in the universe, and it's saying that you APPEAR to be exposed on more than a few common ports, which would indicate that you're either running services (like HTTP, SMTP, etc.) or you have other apps that are holding those common ports open to incoming connection requests... what would you do?

Well, being a smart person, like you are, you would immediately investigate whether-or-not you actually WERE running services, or had apps holding ports open. Now, if after your investigation, you find that you're NOT running those services, and you don't have those ports open, surely you would say that I'm a fruitcake (with nuts).

This is my situation. I need to know if what I'm seeing is my problem (stupdity, mis-configuration, didn't read the manual, etc.) or a problem with TDS-3. Either way, I've got some apologizing and explaining to do, because I staunchly defended the reliability and accuracy of TDS-3, while more than a few people who I have recently scanned and reported incorrect results to were swearing up and down that I was wrong. Now, if this is all my fault, then I'll be happy, no ~~ overjoyed to post here with full apology to any and all who have been inconvienienced by this thread. To convince me that the fault is mine, someone is going to have to show me what I did wrong, or how I messed-up TDS-3 by it's configuration.

If the fault lies with my router, then it also lies with my neighbor's router (also a Linky BEFSR41). I swapped with him earlier and repeated the results on my LAN (remember, where a fresh winME box APPEARS to be running all kinds of services, if TDS-3 is correct). On my LAN, the crazy results I have seen are avoidable if NEITHER computer (the one doing the scan and the one being scanned) is behind a router. I am in the dark as to why or how a router can affect OUTBOUND scans, or scans done internally on the LAN, but since MSN Messenger and others have trouble with routers, it's not out-of-the-question that TDS-3 does, too. It's a given that router will block INBOUND scans, because that's what they do. Please note that I have already been scanned by a TDS-3 user who is behind a router... and in that case there were two routers in the mix (mine and his). He reported to me THE SAME BOGUS RESULTS THAT I'VE SEEN WHEN SCANNING OTHERS. Sorry for the caps, but I wanted the emphasis to be loud.

I don't want any trouble. I don't want to stop using TDS-3. I don't want to be forced to stop supporting DCS, both financially and morally. I don't want to keep punishing Wayne (hi Wayne!)... and I definitely don't want to keep bothering you wonderful people with this whining and crying. I do want to know what is going on, so when I eat crow and apologize in front of all the people I lied to, I'll have all the facts.

I hope my little rant here has given all of you a little insight as to why I'm freaking.

Best Regards to all.

Hilly.