Detected Port Scanning Attack in ESET Smart Security

Question

I receive a number of notifications from ESET Smart Security about Port Scanning attack. But I'm behind a router. But as far as I know, computers behind a router is not accessible from others (Please correct me if I'm wrong). Then how can ESET report about such an attack.

Answer 1

But as far as I know, computers behind a router is not accessible from others (Please correct me if I'm wrong). Well, you are wrong.

A router (or "Internet gateway") is almost transparent to Internet protocol packets: it only decrements the "TTL" field of packets (Time-to-live, the number of routers, and number of seconds, an IP packet can go through before dying/expiring).

To perform IP filtering, you need a firewall. Firewalls are often configured on routers, but it is a distinct function, that must be configured (mostly) inpendantely.

Almost all "NAPT devices" that is Network Address and Port Translation devices:

1. perform, as a side effect of "address sharing", some kind of "inbound" "connexion" filtering: "connexion" is the keyword here, it is a subtle concept, being defined according to the device configuration; "inbound" is another concept that is more subtle than many people think;

2. are often called NAT devices, NAT-routers, or just "routers" (improperly).

A NAPT device look like a router "from the inside" (the LAN ports) and must be configured as the "Internet gateway" on computers connected to the LAN Ethernet ports. But it is wrong to describe a NAPT device as a "router" because:

• it does some simple router stuff, plus very complex "connexion"-tracking and address rewriting stuff;
• "from the outside" (the WAN port), it looks like an Internet host, not a router.