Re: Help with filtered ports

[GuidoZ <uberguidoz () gmail com>]

Usually ports that nmap finds are in "filtered" state means that a
firewall is blocking access to those ports. (Actually, nmap is quite
intelligent being able to discover filtered ports compared to closed.)

It's entirely possible that some software program you are running (be
it a firewall/ids or something that uses special ipchains) is blocking
those ports specifically, hence showing up as filtered instead of
closed. You need not worry about reformatting! The system state should
be perfectly fine, though I'd want to know what program is filtering
the ports.

Do you have a firewall on this server (software or hardware)? What OS
is it? Is there any special anti-trojan software installed (could even
be antivirus)? Answering these questions should help lead you to the
answer.

--
Peace. ~G


On Sat, 13 Nov 2004 21:41:52 -0800 (PST), Juan B <juanbabi () yahoo com> wrote:
> Hi!
>
> I scan with nmap a host in the dmz,I found those ports
> filtered:
>
> 6699/tcp   filtered    napster
> 8888/tcp   filtered    sun-answerbook
> 12345/tcp  filtered    NetBus
> 12346/tcp  filtered    NetBus
> 27374/tcp  filtered    subseven
> 27665/tcp  filtered    Trinoo_Master
>
> I know that subseven and netbus are trojans but what
> does in mean filtered? what is the best sulution to
> fix this problem? format and install this machine?
>
> what is the differance between open and filter ports?
> thanks !!!
>
>
> __________________________________
> Do you Yahoo!?
> Check out the new Yahoo! Front Page.
> www.yahoo.com