RE: an error in the NMAP docs?

["David Gillett" <gillettdavid () fhda edu>]

> -----Original Message-----
> From: Michael Herz [mailto:mherz () uwaterloo ca]
> Sent: Thursday, April 07, 2005 1:15 PM
> To: gillettdavid () fhda edu; security-basics () securityfocus com
> Subject: RE: an error in the NMAP docs?
>
>
>
> > -----Original Message-----
> > From: David Gillett [mailto:gillettdavid () fhda edu] 
> >
> >   The *purpose* of the exception is NOT "to allow the 
> machine to act 
> > as a DNS server".  Its purpose is to allow the client to 
> > receive DNS results even when these are returned using TCP 
> > instead of UDP.
>
> This is exactly what I'm saying too. Right from the beginning 
> I belive ;-)

  No, I'm afraid it isn't.  The bit in quotes is quoted from your
message.

> >   The NMAP docs describe exploiting a FIREWALL configuration 
> > intended to allow machines to act as DNS and FTP CLIENTS.
>
> And this is what I disagree with. To me, the phrase "allow DNS (53) or
> FTP-DATA (20) packets to come  through" implies a server service (ie.
> requests are coming in to my DNS server on port 53).
>
> Sorry for turning this into so many words :-(

  They don't mean to IMPLY anything of the sort.  They're talking
about source port numbers, and you're thinking about destination
port numbers.  The destination services are determined by whatever 
port numbers you're having NMAP scan for, and completely unrelated 
to whether you're using the --source_port option to do it.
  (Since they're talking about --source_port, somebody felt it would 
be redundant to repeat that they're talking about packets FROM ports
20 and 53, and not packets TO those ports.)

David Gillett



---------------------------------------------------------------------------
Earn your MS in Information Security ONLINE
Organizations worldwide are in need of highly qualified information security 
professionals.  Norwich University is fulfilling this demand with its MS in 
Information Security offered online.  Recognized by the NSA as an 
academically excellent program, NU offers you the opportunity to earn your 
degree without disrupting your home or work life.

http://www.msia.norwich.edu/secfocus_en
----------------------------------------------------------------------------