2

I have alot of questions on my mind right now, but I'll only ask the ones that are particularily intriguing me.

First off: - I port-scanned my Public IPV4 address; and it returned a few ports being 'open' and some of them 'filtered' (as you would expect), but I then tried to scan my mate's IPV4 address, who lives a couple of streets away from me (yes, I already made sure that he is okay with this and that I am only doing this for my personal curiosity), and it showed all ports that I scanned were closed and/or filtered. I tried a large number of flags; fragmentation; really slow scan times and types; but every time it would show that all of the scanned ports are closed or filtered. I looked closer and saw that the reason it showed these results were because of there being 'no-respone'. Would this be the firewall/IDS blocking(dropping) the packets? I have trouble thinking so because wouldn't the router atleast reply to something like an Echo request on port 7?

2: -(Pardon my inexperience here)I also port-scanned a single port, 80 on his IPV4 address, it sent me a ICMP Type3/Code13 (Communication administratively prohibited). But the interesting aspect of it was that the reply came from a different IP address, is there an explanation to this? (I had several theories myself but decided to come here for an expert opinion)

3: -Regarding question 2 above, why isn't port 80 always open? If the host is watching a video or listening to some music-streaming website, shouldn't port 80 come up as open? Is this because the port sees that it's not a HTTP oriented packet and automatically blocks it?

I would also love if someone could point me to some links explaining their answer so I can expand my knowledge further and perhaps answer some of my questions by myself.

  • Are the two routers the same? Same ISP? – Jay Oct 20 '15 at 13:21
  • No, they are different. – NKTR022 Oct 20 '15 at 13:24
  • 2
    You really need to edit the title of your question – Ulkoma Oct 20 '15 at 14:16
1

1.) There are some variables at play here. Mainly you are both using different routers (with different configurations) and both using different ISPs. (with different security equipment and policies in effect) Your friend's router doesn't have to reply to anything...it depends on how he has it configured. There is no definite port or protocol that can always be used to determine the asset on the other end is "alive".

2.) It's common for ISP's to block incoming port 80 traffic. This prevents customers from hosting webservers on their personal accounts.

3.) Same as above. Firewalls/routers are stateful, (nowadays anyway) which means that the firewall/router will only respond to a request that was first initiated from inside the network. (unless configured otherwise) To muddy the waters a little bit more, when a NAT is involved (and it almost always is) there are source ports involved. There is a good explanation of source ports here: https://stackoverflow.com/questions/15708011/how-is-source-port-for-http-determined-is-there-ever-collision-in-nat

  • +1 for being able to answer briefly and clearly especially that the first question is quite broad – user45139 Oct 20 '15 at 14:14
1

A few things to add to k1DBLITZ's answer:

1) You have scanned your router from your internal network. Even though you scanned the public IP address, you are accessing your router from the internal interface. I expect if you scanned from your mate's connection, you would see all ports on your router filtered.

The nmap flags for evasive scanning rarely work these days. Only really useful against old misconfigured network devices.

3) There is a distinction between client and server port. HTTP uses port 80 by default, and that applies to the server port. The client picks a high-numbered TCP port in a vaguely random fashion. So a typical web connection would be client port 31234 -> server port 80.

As for links for further reading, you would enjoy the Hacking Exposed series.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.