I didn't realise before, that port scanners had to know what service the port was being used for to exploit it. See, I am learning stuff! /grins.
Leo wrote:
"if it does attempt to probe that (random - ed) port the scanner has no real way to know what service "language" (like SSH) it should talk to the port to make it operate"
Snipped from Wikipedia:
"A port may be forwarded for use by either the TCP protocol, the UDP protocol, or both."
I guess I just assumed that port scanners these days would be intelligent enough to know that non-standard (hence forwarded) ports, must be using one or both of the accepted TCP or UDP protocols.
But that aside, say a port scanner finds a port that it knows what service it's being used for, say POP on port 110, or NNTP on 119. Aren't firewalls configured to accept connections (in the appropriate protocols) through these ports? Can't it then exploit them? and if not, why not? I understand that some protocols are inherently secure, like SSH.
I'll also understand if you don't reply to this one, as it is a little OT. Or maybe there is a more appropriate discussion thread to post this to?
But cheers anyway Leo, for the invaluable understanding and advice you impart.
Oh BTW Steve, are you sure you didn't inadvertently change your internet account password (the one your ISP gave you), and not just the modem's login password?
Another thing to consider is that, even if it only has one physical port, your "modem" is *also* a router. It serves up LAN IP addresses, as does your "router". If by chance the router tries to use the same IP address as the modem (and I have seen that happen) you will have an IP address conflict. Resulting in the loss of your internet connection. But in any case, your modem/router is what's facing the internet, so it's a "no" to your paranoia question.
I really hope Leo doesn't mind if I point you towards a page at portforward dot com. Learning about port forwarding has increased my knowledge of networking appreciably. Even if you never do port forwarding, this stuff worth knowing. You will at least learn why teck support tried to "bridge" your router. /smiles http://www.portforward.com/help/doublerouterportforwarding.htm
Best regards to all. ~Adrian (Lan Down Under)
No. The fundamental difference here is incomming versus outgoing - yes, you may use 110 for POP3, but that's an outgoing connection from your PC to your mail server. Your firewall continues to block 110 incoming connections. In reality there are typically no valid incoming connections in a normal home or small business setup. All the connections you make are outgoing - i.e. initiated by your computers connecting to an outside service.
08-Mar-2010
]]>
A comment on: Change Your Password - No, not that one...
Tech Questions?
Get Answers! -
Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter -
Ask Leo! in your inbox every week.
All content Copyright © 2010.
10-Aug-2011