• 0 Posts
  • 27 Comments
Joined 1 year ago
cake
Cake day: June 27th, 2023

help-circle


  • A benign scan could just be looking for an ftp server to connect to or a repeater or relay server of some sort. There are plenty of open services people make available for free and the fact that you would consider it an attack it doesn’t make it one.

    At minimum you could be alerted to look for someone attempting to connect to your ftp server with a single basic anonymous authentication vs someone flooding that port with known malicious software attacks, and block the latter across your entire network and effectively ignore the former. Really it seems like you’re advertising your lack of imagination in this context than a legitimate lack of possible uses for spoofing open ports.





  • Well, since you ask, it likely depends on whether they’re humorously encouraging you to look at something from a different angle, or if they’ve just discovered a handful of situations that get a chuckle from people who only encounter it occasionally, them proceed to subject everyone to the same ‘second-think’ ad nauseum.




  • At a guess, you might tell the difference between some benign scan and an attempt to actually take advantage of the port, perhaps to use as a trigger to automatically ban an ip address? or a way to divert malicious resources to an easy looking target so they are less available in other areas?

    The difference between someone scanning for open ports and someone attacking a port they find open seems significant enough to at least track and watch for patterns… Whether that’s useful for the majority of users or not is rarely why a feature is implemented.






  • These are nice for when you need to tighten something random and you have no idea what size it might be. They do not excel at being a dedicated tool for a larger job. Definitely a matter of preference, but if you find yourself being the go-to person for assembly, a dedicated tool of the correct size is like night and day. If you find yourself just needing something convenient that can jump from bed frame to electronics project and fit in your pocket, these are the way to go. Personally I’d have a hard time imagining not having both options in different tool boxes.



  • Maybe think of it like one of those big walls of post office mailboxes…behind the wall is your computer and an app might be waiting for a message at box 22 or box 45678. You could close all the boxes and nothing could get in, or you could open one or all of them and allow people to deliver messages to them.

    If you connect your computer directly to the internet, anyone who knows your IP address could say 'deliver message X to port 22 at ip address <your ip address> and the program watching that box would get the message.

    If you put a router in the mix, and multiple computers, the router has the same block of boxes, but if someone sends a message to one of the boxes it just sets there. If you set up ‘forwarding’, sending a message to your ip address gets the message to the router, but if you forward box 22 from your router to a specific computer on your network, then the router takes a message at box 22 on itself and ‘forwards’ it to box 22 on whatever computer you specific (using internal ip addresses).

    You could map box 22 on your router to any other box on your computer…like port 22 coming into your router might get sent to port 155 on your computer…this is useful if you don’t want external people just exploring and lazily breaking into your computer using known vulnerabilities. Lots of ports are ‘common’, so an ftp hack on port 22 is easy, and might be ‘slightly’ harder if you tell your computer to actually look for ftp traffic on port 3333 or something.