Re: Port Zero
Lee Dilkie <[email protected]>
| Newsgroups | gmane.comp.security.incidents |
|---|---|
| Message-ID | <[email protected]> |
How about a *much* simpler explanation... a LISTENING socket has no "foreign address". It's not connected so how could it? That column is meaningless for sockets not in a CONNECTED state. -lee Ron wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >Looks to me like it's not set. Because there's no active connection, >there's no foreign address. > >A socket that's listening won't have a foreign address set, and a socket >that's connected will. > >I noticed on Linux, it looks like this: >iago@darkside:~$ netstat -a | grep LISTEN >tcp 0 0 *:8001 *:* LISTEN >tcp 0 0 *:3306 *:* LISTEN >tcp 0 0 *:http *:* LISTEN >tcp 0 0 *:ssh *:* LISTEN >tcp 0 0 *:https *:* LISTEN > >Probably 0.0.0.0:0 is just Windows's way of saying "not set"? > >[email protected] wrote: > > >>Active Connections >> >> Proto Local Address Foreign Address State >> TCP 0.0.0.0:135 0.0.0.0:0 LISTENING >> TCP 0.0.0.0:445 0.0.0.0:0 LISTENING >> TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING >> TCP 0.0.0.0:1028 0.0.0.0:0 LISTENING >> TCP 0.0.0.0:1054 0.0.0.0:0 LISTENING >> TCP 0.0.0.0:1307 0.0.0.0:0 LISTENING >> TCP 0.0.0.0:1344 0.0.0.0:0 LISTENING >> TCP 0.0.0.0:1445 0.0.0.0:0 LISTENING >> TCP 0.0.0.0:1447 0.0.0.0:0 LISTENING >> TCP 0.0.0.0:1452 0.0.0.0:0 LISTENING >> TCP 0.0.0.0:1453 0.0.0.0:0 LISTENING >> TCP 0.0.0.0:1455 0.0.0.0:0 LISTENING >> TCP 0.0.0.0:1460 0.0.0.0:0 LISTENING >> TCP 0.0.0.0:1465 0.0.0.0:0 LISTENING >> TCP 0.0.0.0:1466 0.0.0.0:0 LISTENING >> TCP 0.0.0.0:1469 0.0.0.0:0 LISTENING >> TCP 0.0.0.0:1491 0.0.0.0:0 LISTENING >> TCP 0.0.0.0:1496 0.0.0.0:0 LISTENING >> TCP 0.0.0.0:1498 0.0.0.0:0 LISTENING >> TCP 0.0.0.0:1507 0.0.0.0:0 LISTENING >> >>Above is the output of netstat -an |more >> >>Guys / Gals Do you know what means port zero in Windoze Platform ? I know the answer but jst wanted to know anyone has a better explaination. >> >>In Unix Family port zero is used for socket programming but not the same in Windoze family. >> >>I have asked this question in many programs of mine in CEH - Certfied Ethical Hacking but still awaiting for answers. Lemme see if can get some answers for this post!!!! >> >>Ciao >> >>Baba >>CEO >>Appsec >> >> >> >> >-----BEGIN PGP SIGNATURE----- >Version: GnuPG v1.9.15 (GNU/Linux) >Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org > >iD8DBQFC2p3XfqSf2EkP4p4RAky6AJ4uVgpt37oxTENJ3wjd9luWH8Jb/wCeOqO5 >Sy6WrEhqEVR5SuOAQiQDgOM= >=5KEZ >-----END PGP SIGNATURE----- > >
smime.p7s
(application/x-pkcs7-signature, 3.3 KB) - not displayed