1. Home
  2. Networking Firewalls
  3. What is blocking my ports?

What is blocking my ports?

Posted this on microsoft networking ng without solution.

------------ XP SR2 I am having getting Tivo to 'talk to' my PC over a wireless network. Went to Tivo support and forum but was unable to get an answer. I have a Dell router. PC ic connected to the PC via ethernet. Tivo is connected wirelessly Notebook is connected wirelessly. PDA connected wirelessly for net use only. PC, notebook, and PDA work. Tivo lists an IP address and signal strentgh is good to excellent. Notebook can see Tivo and can download files to HD. PC can not find Tivo. However, when I open Tivo sw on the PC Tivo's correct IP is listed. When I ping Tivo (ping xxx.xxx.x.x), I get 4 packets sent/received. Per Tivo, I entered URL https://xxx.xxx.x.x into my browser, entered name and password, and the PC can see Tivo but can not download. Tivo say this confirms the problem is a blocked port. I have literally uninstalled Norton antivirus and firewall, disabled XP firewall, and tried again. Keep getting a mesage from Tivo (on the PC)about an error on trying to communicate which Tivo says indicates a port problem. I have been told by an expert (a friend how knows more than I do) that since Tivo can talk to my notebook through the router, the problem with the PC is not the router or the router firewall. I have a list of ports to open but since, at the time, I had no without a firewall, I had no sw to tell to open ports or allow programs. I have, btw, reinstalled the firewall and antivirus sw. How can I find what is blocking those ports or, is it possble the ports are defective? Since posting this elsewhere I was directed to an app called PortQryUI. Ran the check of required ports with the firewall uninstalled and Windows Firewall disabled. Although this may give me answers, I have no idea what this is telling me (what is 'filtered?').

TCP 37 Filtered 443 Listening 2190 Listening 4430 Filtered 7287 Filtered 7288 Filtered 8000 Filtered 8100 Filtered system idle process 8200 Filtered 8080-8089 Filtered UDP 123 Filtered or listening scvhost 2190 Filtered or listening

Reply to
J Lunis
Loading thread data ...

So your PC can find the Tivo box. Why did you claim it cannot?

Did your check device manager for rest of drivers? It's pretty hard to repair networking functionality being broken due to having installed Norton products. Better flatten and rebuild.

Very very bad.

Hm... install a network sniffer? What does the netstat command tell you? What about a port scan with Nmap?

No. Ports are numbers.

I don't either, because you didn't active comprehensive logging or used a serious 'netstat' alternative. What about TcpView?

I hope you meant 'svchost'...

Reply to
Sebastian Gottschalk

Well, According to Tivo support, the error I receive when trying to get Tivo sw on the PC to 'talk to' the DVR ('there was an error while attempting to retrieve data') is an indication the required open ports are blocked. When I said the PC can't find the DVR I was obviously wording it incorrectly. The PC can find the DVR but the sw can not find open ports.

Don't know what you are suggesting here. If I read you correctly, when I uninstalled Norton, it may have left behind some drivers. I checked a number of device Manager listings and didn't see any reference to Norton. Any particular place to look?

Yeah, I figure. Looking now at Kerio. Seems to get good reviews.

Apparently doing something wrong with netstat. I run it, I see the command screen for 1-2 seconds with some kind of text, but it closes far too fast for me to read it. Nmap? That's new to me. I'll have to find it. I suppose a web search will turn it up?

TcpView. For example, if I understand what it is showing me, TivoBeacon.exe:1124 TCP HomeComputer:8200 HomeComputer:0 Listening I suppose 'listening ' is good and the port isn't blocked. A number of ports I need open (8080-8089) don't appear on TcpView. And the above data is with Windows firewall disabled.

yup.

Reply to
J Lunis

"*sym*","*nis*" and "*npf*"

Except by serious security experts. Well, "personal" "firewalls" are all the same shit.

D'oh! What about opening a command prompt window first?

Yes.

If it doesn't appear on TcpView (or netstat), then there's no server listening locally and no client trying to connect (TcpView highlights new connection attempts). Hm, I guess Nmap would give a better clue here.

Reply to
Sebastian Gottschalk

OK Sebastian, I'll be a few days running through all the devices and eliminating Norton drivers. And I'll be a day or two working on Ntap. I am seeing a pattern here FWIW. With no firewall, no antivirus, and Tivo open, I have run PortQryUI, netstat, and tcpview. PortQryUI shows the following ports TCP 37 Filtered 443 Listening 2190 Listening 4430 Filtered 7287 Filtered 7288 Filtered 8000 Filtered 8100 Filtered system idle process 8200 Filtered 8080-8089 Filtered UDP 123 Filtered or listening svchost 2190 Filtered or listening

netstat -a only shows 8100 and 8200 listening TcpView shows only 2190 8100 8200 listening

I am presum> J Lunis wrote:

Reply to
J Lunis

It sounds like a wireless problem to me if you have dropped the PFW(s) and no success.

You can confirm this by using a wire connection with the machine in question. You can turn on the PFW(s) too and if it still works, then you should look at the wireless.

Duane :)

Reply to
Duane Arnold

You really have an attitude problem. I've been using Kerio PFs for years and have *never* had any problems with Win2K.

Reply to
Alan Illeman

Except being vulnerable to certain remote DoS conditions, breaking some network functionality and RFC-conformirty, and opening a privilege escalation path.

Hint: I've been running Win2K without any PFWs and never had any problems (well, except due to dying hardware). Why exactly should I increase the system's complexity (reducing its security) for achieving nothing except more errors and vulnerabilities?

What about serious host-based packet filters?

Just to add for fun: Kerio PFW is based on the same kernel as Kerio WinRoute. Kerio WinRoute has been ISCA-certied under the "basic firewall" profile. The link on the Kerio website is broken, but you can still find it at ICSA's website. Read it, understand it, and cry - their implementation is so lousy that they didn't pass the test in first place and hardly passed at all with only some fast-and-dirty patches for the most serious problems.

Reply to
Sebastian Gottschalk

More errors and vulnerabilities? Get it through your thick head that what I said was that I've experienced no infections at all. The fact that you are not using a PFW simply means that perhaps you are more 'expert' in these matters, luckier or just trolling.

Reply to
Alan Illeman

This is what your claim. Judging from your experience of auditing packet filter vulnerabilities and security concepts you don't have the experience to such such a thing either. Most likely you just didn't notice anything.

And even if nothing happened, one can safely conclude that this was not due to the PFW.

Mind you, PFWs are exactly not suitable for non-experts.

Reply to
Sebastian Gottschalk

If you had vulnerabilities, this did not enforce infections, but made them possible.

If you had infections, this did not enforce you to notice that, but made it possible.

At least one of the above did not happen.

Yours, VB.

Reply to
Volker Birk

And the fact (assuming it actually is a fact) that you personally have not experienced any infections while using a personal firewall doesn't mean anything at all. It's a fact that a personal firewall may increase one's exposure due to flaws in the personal firewall software regardless of your personal experience with them.

cu

59cobalt
Reply to
Ansgar -59cobalt- Wiechers

Checked all Device Manager entries. None in use with "*sym*","*nis*" and "*npf*"

This appears somewhat controversial as the thread continues. What PFW for an intermittent non-expert would you suggest?

OK, can't get NMap 4.03 to run. Hate to tell you this but it appears to complex for me. How would I, for example, check port TCP 1000?

Reply to
J Lunis

You calling me a liar?

Reply to
Alan Illeman

True

Had no infections

Your point?

Reply to
Alan Illeman

You calling me a liar too?

firewall doesn't

I beg to differ. Before I had a pf I had lots of infections.

True

So what's your point?

Reply to
Alan Illeman

No, I'm calling you unable to make observations to draw such conclusions. And I'm calling your argument totally defective.

Reply to
Sebastian Gottschalk

Then you have a serious problem in your non-existent security concept. If your host is vulnerable without a packet filter, then it also is with such one.

Reply to
Sebastian Gottschalk

Exactly: none

A packer filter will only give you security if you have in-depth knowledge about networks, TCP/IP and firewalls. As a non-expert you have none, so you'll just achieve misconfiguration, insecurity and messages you don't understand (and therefore cannot make any qualified decisions).

What about disabling unnecessary services? It's kinda trivial to get an empty netstat output (freshly after reboot) even on Windows. There's no need to harass with packet filtering, and security is pretty much based on reducing unnecessary complexity.

For a detailed view:

nmap -sS -p1000 -O $yourIP nmap -sS -p1000 -O -f $yourIP nmap -sA -p1000 -O $yourIP nmap -sF -p1000 -O $yourIP nmap -sN -p1000 -O $yourIP nmap -sX -p1000 -O $yourIP nmap -sM -p1000 -O $yourIP nmap -sW -p1000 -O $yourIP

Reply to
Sebastian Gottschalk

OK, tried every NMap line you gave me on several ports. Tried each line on the IP for my laptop, PDA, and Tivo DVR. Tried each line with the firewall enabled and disabled. In every case, I received the same messge >>

"NOTE: Host seems down. If it is really up, but blocking our ping probes, try -P0 (can't see the rest of this line)." "NMap finished: 1 IP address (0 hosts up) scanned in 4.813 seconds." what have I learned?

Reply to
J Lunis

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.