Port Scanner

[Harry]

I just picked up a free local port scanner that I got from http://www.webattack.com/get/lps.shtml

It is a curious little program that says that my ports 135 and 1025 are open. Should I be worried.

[mairving]

Well it depends on who it is open to. If port 135 is open to the whole world, then yes you have problems. If port 135 is open only to your local network and is blocked externally by a firewall or router, then there is no problem. Go over to Grc and run their Shields Up utility. It will tell you what ports are open to everyone.

[Harry]

Thanks,

I know that this is a lot of mumbo jumbo but just for the record I'm going to post the shields up results and begin with the summation of the report.

Results from scan of ports: 0, 21-23, 25, 79, 80, 110, 113,
119, 135, 139, 143, 389, 443, 445,
1002, 1024-1030, 1720, 5000

1 Ports Open
22 Ports Closed
3 Ports Stealth
---------------------
26 Ports Tested

The port found to be OPEN was: 1025

Ports found to be STEALTH were: 135, 139, 445

Other than what is listed above, all ports are CLOSED.

TruStealth: FAILED - NOT all tested ports were STEALTH,
- NO unsolicited packets were received,
- A PING REPLY (ICMP Echo) WAS RECEIVED.
--------------------------------------------
Solicited TCP Packets: RECEIVED (FAILED) — As detailed in the port report below, one or more of your system's ports actively responded to our deliberate attempts to establish a connection. It is generally possible to increase your system's security by hiding it from the probes of potentially hostile hackers. Please see the details presented by the specific port links below, as well as the various resources on this site, and in our extremely helpful and active user community.

Unsolicited Packets: PASSED — No Internet packets of any sort were received from your system as a side-effect of our attempts to elicit some response from any of the ports listed above. Some questionable personal security systems expose their users by attempting to "counter-probe the prober", thus revealing themselves. But your system remained wisely silent. (Except for the fact that not all of its ports are completely stealthed as shown below.)

Ping Reply: RECEIVED (FAILED) — Your system REPLIED to our Ping (ICMP Echo) requests, making it visible on the Internet. Most personal firewalls can be configured to block, drop, and ignore such ping requests in order to better hide systems from hackers. This is highly recommended since "Ping" is among the oldest and most common methods used to locate systems prior to further exploitation.

Port
Service
Status Security Implications

0

Closed Your computer has responded that this port exists but is currently closed to connections.

21
FTP
Closed Your computer has responded that this port exists but is currently closed to connections.

22
SSH
Closed Your computer has responded that this port exists but is currently closed to connections.

23
Telnet
Closed Your computer has responded that this port exists but is currently closed to connections.

25
SMTP
Closed Your computer has responded that this port exists but is currently closed to connections.

79
Finger
Closed Your computer has responded that this port exists but is currently closed to connections.

80
HTTP
Closed Your computer has responded that this port exists but is currently closed to connections.

110
POP3
Closed Your computer has responded that this port exists but is currently closed to connections.

113
IDENT
Closed Your computer has responded that this port exists but is currently closed to connections.

119
NNTP
Closed Your computer has responded that this port exists but is currently closed to connections.

135
RPC
Stealth There is NO EVIDENCE WHATSOEVER that a port (or even any computer) exists at this IP address!

139
Net
BIOS
Stealth There is NO EVIDENCE WHATSOEVER that a port (or even any computer) exists at this IP address!

143
IMAP
Closed Your computer has responded that this port exists but is currently closed to connections.

389
LDAP
Closed Your computer has responded that this port exists but is currently closed to connections.

443
HTTPS
Closed Your computer has responded that this port exists but is currently closed to connections.

445
MSFT
DS
Stealth There is NO EVIDENCE WHATSOEVER that a port (or even any computer) exists at this IP address!

1002
ms-ils
Closed Your computer has responded that this port exists but is currently closed to connections.

1024
DCOM
Closed Your computer has responded that this port exists but is currently closed to connections.

1025
Host
OPEN! One or more unspecified Distributed COM (DCOM) services are opened by Windows. The exact port(s) opened can change, since queries to port 135 are used to determine which services are operating where. As is the rule for all exposed Internet services, you should arrange to close this port to external access so that potential current and future security or privacy exploits can not succeed against your system.

1026
Host
Closed Your computer has responded that this port exists but is currently closed to connections.

1027
Host
Closed Your computer has responded that this port exists but is currently closed to connections.

1028
Host
Closed Your computer has responded that this port exists but is currently closed to connections.

1029
Host
Closed Your computer has responded that this port exists but is currently closed to connections.

1030
Host
Closed Your computer has responded that this port exists but is currently closed to connections.

1720
H.323
Closed Your computer has responded that this port exists but is currently closed to connections.

5000
UPnP
Closed Your computer has responded that this port exists but is currently closed to connections.

[kadaver]

Are you running a firewall?

GRC themselves have a good explanation of what port 135 is and what it is used for:

http://grc.com/port_135.htm