On my Cisco Router, I do a nmap scan from outside on the Internet. The result
is:
" Interesting ports on *.*.50.1:
Not shown: 1676 closed ports
PORT STATE SERVICE
23/tcp filtered telnet
135/tcp filtered msrpc
1524/tcp filtered ingreslock
27665/tcp filtered Trinoo_Master
I am worried about the last two entries. The last nmap was done in Feb this
year and I have confirmed that the two port entries (tcp 1524/27665) did not
exist then.
Though the port state "filtered" is a solace but I am still concerned. How can
I be sure that the system has not been compromised?
Also the current IOS Version of my Router 2811 is 12.4. It was the same case
with open ports when I was using older Router Series 1700 v 12.2, so I thought
maybe, it's an IOS issue and I upgraded my Router to 2811 with IOS v 12.4
yesterday. But as soon as I plugged it into the circuit and did a re-scan, I
realised the nmap again gives the trinoo_master entry with state as filtered.
Where could lie the problem. Is it with my firewall (PIX 515) configuration
behind the router?
Please Advise!!
I have seen Cisco's tech doc that exists here:
http://www.cisco.com/en/US/partner/tech/tk59/technologies_white_paper09186a0080174a5b.shtml
One of the solutions suggested therein is to implement "ip verify unicast
reverse-path" on the serial interface, but am not sure what will it serve?
Also, I suspect that I had other problems when I gave this command so I
reversed it.
"sh process cpu" only shows cpu utilisation of about 5-6%.
Please advise!!
------------------------------------------------------------------------------
This List Sponsored by: Black Hat
Attend the Black Hat Briefings & Training USA, July 29-August 3 in Las Vegas.
World renowned security experts reveal tomorrow's threats today. Free of
vendor pitches, the Briefings are designed to be pragmatic regardless of your
security environment. Featuring 36 hands-on training courses and 10 conference
tracks, networking opportunities with over 2,500 delegates from 40+ nations.
http://www.blackhat.com
------------------------------------------------------------------------------
