Am Don, 2003-08-14 um 09.54 schrieb cc: > Rob Sterenborg wrote: > > > > No. I am interested too in why udp shows "open" from a foreign host, > > while tcp shows filtered. > > How can I check if an udp port is really closed/filtered or opened ? > > I'm completely stumped on this issue. There are three possible responses to an udp probe as nmap sends it: 1. Port is closed. OS hopefully sends an ICMP-Port-Unreachable 2. Port is open. Either the application sends an error via UDP or does not answer at all 3. Port is filtered. No response since the original packet is dropped. When you compare 2 and 3, you will see that nmap cannot distinguish between an open and an filtered port. Thus nmap will mark all (drop) filtered and open ports as open and will recognize only closed and rejected ports as closed. Cheers, Ralf -- Ralf Spenneberg RHCE, RHCX Book: Intrusion Detection für Linux Server http://www.spenneberg.com IPsec-Howto http://www.ipsec-howto.org Honeynet Project Mirror: http://honeynet.spenneberg.org
