1

My objective is to do a port scanner in windows and find the ports which are open. Suppose, I run an application which opens up a port 8000. Now I create a new inbound rule to block all incoming packets on port 8000. So now is the port technically open?

My requirement: Find all the ports which are open? That is, find the ports which are allowed by firewall and are open.

The ports which are blocked by firewall are anyway going to be shown as "open" on netstat but I do not want that information since it has already been taken care of.

Any ideas on how to proceed with it?

  • Run nmap against the host from a different machine. – postoronnim Nov 19 '18 at 18:02
  • @postoronnim Any idea of how to do it by not depending on other machines and do it from my machine itself? – Oxia Nov 20 '18 at 8:06
  • If you blocked the port is cannot be open. – Overmind Nov 20 '18 at 11:10
  • @Overmind in netstat it will still be shown as "listening" – Oxia Nov 20 '18 at 13:04
  • That is not relevant. Your application is listening for nothing since nothing gets through to it or from it on that port. – Overmind Nov 21 '18 at 6:33
1

To explain things in a simple manner: ports can have 3 general states:

Blocked - (by firewall or any equipment between source and destination) - nothing gets through in either direction. Everything is denied.

Normal - (default state in most cases) - you can request connection towards anywhere and they will work, but incoming connections towards you are not permitted. A connection will work if you (the source) initializes it. If someone from outside initializes it, it will not work.

Open (sometimes called forwarded such in the case of NAT) - all connections can go through both ways. Anything incoming via such port will be allowed.

If an application is active and listens to a port, it will only be able to receive incoming connections if the port state is Open, it will be able to initialize connections if Open or Normal and will not be able to do anything if Blocked.

  • I got it! One last question: Consider I block RDS ports but when I use netstat, the ports will still be shown as "LISTENING" right? Technically it doesn't allow any connection, so the port is not vulnerable? According to my requirement, I need to do port scan and show which ports are vulnerable. – Oxia Nov 21 '18 at 9:44
  • Yes, it will show as 'Listening' because RDS service does continue to listen to it. The vulnerability of the port in such a case is determined by how your network is setup. A firewall may block it towards internet or other sub-networks, but it could work between your internal network computers. If you block it by the firewall setting of the server itself, then no, it's not a vulnerability. – Overmind Nov 21 '18 at 11:23

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.