Firewall Stealth Mode?

Both your understanding, the explaination and the "stealth mode" itself are nonsense.

Your understanding, the explaination and the "stealth mode" itself are nonsense.

So then help them smart guy instead of insulting them, or is that all you can do?

Jason

I assume that he's able to read RFC 793 by himself.

This is wrong.

Hm... sounds like you didn't understand what he was telling you, or he was confused ;-)

But "stealthing" is nonsense anyways.

Yours, VB.

That's because you can't explain it, like most of what I've seen you post, to where it would make sense to you or the OP. Keep spouting what VB's teaching you.

Would you please kindly elaborate your points of view?

Thanks,

A Monk

Would you be kind enough to illustrate it?

Thanks,

A Monk

I can, as I did the first 2 or 3 times. But at a certain point this is boring, so now only for references.

So far this was my opinion before I ever knew VB. But it seems like you're just ranting and throwing around with stating your opinion as facts. Anyway, you're getting offtopic

Read RFC 793, on page 22 there's a nice ASCII graphic of how TCP is supposed to work.

Stealthing is just misunderstanding protocols. Usually, people mean "not sending ICMP port unreachable or TCP RST on an incoming TCP SYN", when they're using the term "stealting".

This breaches TCP and/or ICMP. And that's all. There is no gain in security by doing so at all.

But if a TCP server is listening on an interface, and the service should work, then of course the TCP server has to do a TCP handshake when a connection is tried. So of course, everybody who tries out a connection will "see" this server.

Yours, VB.

Sebastian Gottschalk wrote: ["Leythos"]

Hm... perhaps some day you'll realize, that this "Leythos"-thing is a prattling mock "expert" of a k00k, Sebastian ;-) On this special day, maybe you'll decide to add him to your killfile, too...

Yours, VB.

Yes, that's all he ever does. It's very 1930's/1940's chic.

A wise man once said: If you want to get a good answer, you should ask a reasonable question first. He wanted comments, he got comments. I don't know if he justed wanted to hear that this consultant was wrong, or that he was wrong as well, or that "stealth" is stupid as well. Maybe he just wanted to hear what he would like to hear. Or maybe he wanted candy.

Anyway, for you one nice word: off-topic.

If he knew about it - maybe so. If he knew how to use google, he wouldn't have had to ask in the first place. But he doesn't know that - so either give him the clues or don't bother wasting everyones time and bandwidth with totally useless non-answers.

Old guy

Posting from... windoze. No, a scanning tool will get one of three results looking at a single port.

CLOSED The remote host said "no service here" either because there is no server running on that port, or a firewall is restricting what addresses may connect.

OPEN There is a server running, and at least the initial stage of a connection is made.

FILTERED No answer received (open _or_ closed) because of a firewall.

Thing is, there are 65000+ TCP ports, _another_ 65000+ UDP ports, and 135+ other protocols besides TCP and UDP. If you want to remain invisible, not only does your firewall have to remain silent for all of those ports and all of those protocols, but your _upstream_ has also got to remain silent as well. Think how the Internet works. You don't connect via a direct wire to every system. You send packets to a router, and that router sends it to another, and that one sends it to another... this continues until it reaches the destination. At any step along the way, a router can go down, and then the router _before_ it sends back a message that says "can't get there". Where "stealth" fails is that message. Your ISP sees that you are connected, so it _doesn't_ send back that message. So if I get nothing at all - I know you exist, but are trying to hide.

If that's really what was said, find a new conslutant - this one has serious knowledge problems. That is like ignoring someone who speaks using language A - say Armenian, and then when the person tries to speak using language B - say Belgian, you act normally.

Except that in another thread you've just been boring, not posting any links with information that provides details, such as vendor/firmware tested, etc...

It's hard to believe someone that quotes others works and then can't back them up with believable experiences or facts concerning the exploit testing methods on specific versions/firmware.

Or, maybe one day, you'll be able to back up your claims and explain why your exploit code doesn't work on a protected network/system.

I almost forgot, you KF me after I posted that your POC didn't work on any of my computers that were properly secured - in fact, you didn't even reply saying anything, except that you KF me since you needed to hide the fact that your POC is just a trick.