access - list 101 deny tcp any any eq 256 log ! Block Firewall-l scans access - list 101 deny tcp any any eq 257 log ! Block Firewall-l scans access - list 101 deny tcp any any eq 258 log ! Block Firewall-l scans access - list 101 deny tcp any any eq 1080 log ! Block Socks scans access - list 101 deny tcp any any eq 1745 log ! Block Winsock scans
1 stoneface (192.168.10.33) 12.640 ms 8.367 ms 2 gw1.localisp.net (172.31.10.1) 214.582 ms 197.992 ms 3 gw2.localisp.net (172.31.10.2) 206.627 ms 38.931 ms 4 dsl.localisp.net (172.31.12.254) 47.167 ms 52.640 ms ........ 14 ATM6.LAX2.BIGISP.NET (10.50.2.1) 250.030 ms 391.716 ms 15 ATM7.SDG.BIGISP.NET (10.50.2.5) 234.668 ms 384.525 ms 16 client-gw.smallisp.net (10.50.3.250) 244.065 ms ! X * * 17 * * * 18 * * *
C:\TEMP>nc -v -n 192.168.51.129 25 [UNKNOWN] [ 192.168.5l.129 ] 25 ( ? ) open 421 fw3.acme.com Sorry, the firewall does not provide mail service to you.
Trong và dụ sau đây, hping báo cáo cổng 80 Ä‘ang mở và sẵn sà ng nháºn má»™t tuyến nối. Ta biết Ä‘iá»u nà y bởi nó đã nháºn má»™t gói tin vá»›i cá» SA đợc ấn định (má»™t gói tin SYN/ACK).
# hping http://www.yourcompany.com -c2 – S -p80 -n HPING http://www.yourcomapany.com ( eth0 172.30.1.2 0 ) : S set, 40 data bytes 60 bytes from 172.30.1.20 : flags=SA seq=0 ttl=242 id= 65121 win= 64240 time=144.4 ms
# firewalk -pTCP -S135 -140 10.22.3.1 192.168.1.1 Ramping up hopcounts to binding host . . . probe : 1 TTL : 1 port 33434 : expired from [exposed.acme.com] probe : 2 TTL : 2 port 33434 : expired from [rtr.isp.net] probe : 3 TTL : 3 port 33434 : Bound scan at 3 hops [rtr.isp.net] port open port 136 : open port 137 : open port 138 : open port 139 : * port 140 : open
access - list 101 permit icmp any 172.29.10.0 0.255.255.255 8 ! echo access - list 101 permit icmp any 172.29.10.0 0.255.255.255 0 ! echo- reply access - list 102 deny ip any any log ! deny and log all else