I have been investigating logs from the firewall (Juniper) and I've found out that when someone is portscanning my website, the majority of the traffic through different tcp/udp ports is denied (except for ports 80 and 443, which is allowed). However, traffic is allowed through some of the ports that it shouldn't be, for example, ports 4800, 502, 21025, 88. But after inspecting the log it also says 'CLOSE - age out'. Does that mean that the attacker managed to initiate a session but no traffic was sent for a certain amount of time ? Does the attacker get any information from these different responses ? To clarify: I do not have access to check what is the exact firewall configuration.
Some Juniper devices log TCP RST packets as age out. This is to do with how the ASICs handle the timeout - see here.
A RST packet would be expected behaviour when a SYN based port scanner is allowed through the firewall on a given port. SYN scanners send the initial SYN packet to establish the TCP connection.
- For a closed port most systems would reject this by sending a RST packet (thus letting the client know and not leaving them to time out).
- For an open port the client would respond with an ACK. The scanner then (usually) sends a RST so the server knows it can close the connection.
- Worth noting this could also legitimately be a time out. I.e. a connection is established but no packets are received within the firewalls timeout limit.
If you are seeing age out on those ports it would suggest the packets do make it through the firewall. Without seeing more information from the log, firewall configuration or server configuration it is difficult to speculate on both why these are allowed through and how far through the connection the process gets.