Interesting Nmap report

**mcdougrs** · 05-14-2003, 06:09 PM

Hey all,

I just downloaded and installed Nmap for Windows 2000 (I'm at work

) so that I could scan my network at home... Well the normal SYN stealth scan came back as expected, but then I decided to do a UDP scan... EVRYTHING was open

. What does that mean? Does that mean that my router just doesn't block UDP traffic? And also just because they are open doesn't mean anything right? They should show a status of Listening before I start to worry right?

**Blaqb0x** · 05-14-2003, 07:10 PM

That's interesting. what type of router do you have?

Are you running, Norton Personal firewall? I remember using superscan and scanning machines when the firewall was on and it came up with all kinds of bogus responses.

Have you checked your router's virtual hosts settings. you could possibly have a range of UDP ports pointing to some bogus internal machine.

**mcdougrs** · 05-15-2003, 12:20 PM

I'm using a Netgear MR314(I think thats the model), cable router w/ wireless. I am also running Norton Firewall on my Windows box behind the router. I'll have to check those settings at home sometime.

Thanx for the help/reply!

**tolstoy** · 05-16-2003, 12:04 AM

Whenever I nmap any of my Win2k hosts, especially my domain controllers, I get a billion open upd ports, even on new installs. As far as I can tell, there is nothing running on them, since my firewalls would have logged all outgoing upd traffic and my nessus audits turn up nothing unusaly on those ports. I could, however, be wrong and have a million backdoors running on all my boxes, but I would like to doubt that possibility as it is frightening.

As for your router, unless it is also a firewall, it will pass all layer three traffic unless it is broadcast or multicast-based (this includes udp).

**KumaSan** · 05-24-2003, 04:47 AM

Nmap will tell you an udp port is open unless it receives a port closed message, thanks to the connectionless nature of udp ports. This is normal. One of many reasons that udp port scanning has been called more of an art than a science. Don't worry too much about those open ports, unless you actually find something listening on your box.

A netstat -anu should show all listening udp ports.