Some protocols (again)

Protocols guarddog has not support yet but are useful to have
	TFTP: (for network booting)
	netconsole: (for kernel debugging)
	rdesktop: (for remote windows view)
	svnserve: (for non ssh suvbersion users)
	smtp over SSL: (It is deprecated but maybe useful for some)

Others not listed here:
	apt-proxy: (port = 9999, Debian apt proxy daemon)
	SANE: (cannot be firewalled properly. Seriously compromises sustem security)

<protocol name="tftp">
   <longname>TFTP - Trivial File Transfer Protocol</longname>
   <description>A Very simple protocol used to transfer files during the boot time of
   diskless clients.</description>
   <classification class="net"/>
   <pragma name="guarddog">ip_conntrack_tftp</pragma>
   <network>
     <udp source="client" dest="server" direction="both">
       <dest><port portnum="69"/></dest>
     </udp>
   </network>
   <security threat="high" falsepos="low"/>
   <reference href="http://www.robertgraham.com/pubs/firewall-seen.html">
   FAQ: Firewall Forensics (What am I seeing?)</reference>
</protocol>

<protocol name="netconsole">
   <longname>netconsole</longname>
   <description>A protocol used for kernel debugging.</description>
   <network>
     <udp source="client" dest="server" direction="both">
       <source><port portnum="6665"/></source>
       <dest><port portnum="6666"/></dest>
     </udp>
   </network>
   <security threat="high" falsepos="low"/>
   <reference href="http://www.robertgraham.com/pubs/firewall-seen.html">
   FAQ: Firewall Forensics (What am I seeing?)</reference>
</protocol>

<protocol name="rdesktop">
   <longname>rdesktop - Windows Terminal Service</longname>
   <description>A protocol used to enable remote access of your Windows
machine</description>
   <classification class="session"/>
   <network>
     <tcp source="client" dest="server">
       <description>Request connection.</description>
       <source><port portnum="dynamic"/></source>
       <dest><port portnum="3389"/></dest>
     </tcp>
   </network>
   <security threat="high" falsepos="low"/>
   <reference href="http://www.robertgraham.com/pubs/firewall-seen.html">
   FAQ: Firewall Forensics (What am I seeing?)</reference>
</protocol>

<protocol name="svnserve">
   <longname>subversion - svn simple server</longname>
   <description>A protocol used to enable remote access to your subversion repositories</description>
   <classification class="file"/>
   <network>
     <tcp source="client" dest="server">
       <description>Request connection.</description>
       <source><port portnum="dynamic"/></source>
       <dest><port portnum="3690"/></dest>
     </tcp>
   </network>
   <security threat="high" falsepos="low"/>
   <reference href="http://www.robertgraham.com/pubs/firewall-seen.html">
   FAQ: Firewall Forensics (What am I seeing?)</reference>
</protocol>

protocol name="smtp over SSL">
   <longname>SMTP - Simple Mail Transfer Protocol over SSL</longname>
   <description>SMTP is used to transfer and deliver email across the network.
   It is the standard for transmitting email across the Internet. This enables
   the SSL (secure socket layer) SMTP transmission. Note that this method
   for mail transmission is deprecated and you should use TLS instead which
   uses the normal port 25 instead.
</description>
   <classification class="mail"/>
   <network>
     <tcp>
       <source><port portnum="dynamic"/></source>
       <dest><port portnum="465"/></dest>
     </tcp>
   </network>
   <security threat="medium" falsepos="low"/>
   <reference href="http://www.robertgraham.com/pubs/firewall-seen.html">
   FAQ: Firewall Forensics (What am I seeing?)</reference>
</protocol>


-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642