Jza

Hi guys and gals,

Someone at work was discussing having certain ports left unblocked and how hackers can get round software firewalls if you leave them open.

I ran something called netstat from the cmd prompt. The following are "ESTABLISHED". Looks like too many to me but i dont know if its good or bad!!!

Local Address Foreign Address
1025 1063
1025 1064
1060 1065
1060 1066
1063 1025
1064 1025
1065 1060
1066 1060

Does anyone know anything about this and if i should block any of these ports?

Then... how do you block ports?

Thanks!

Jza

mike1210

they are client ports communicating on the internet id imagine, nothing to worry about there. You could try a scan on this website

http://www.grc.com/default.htm

select shields up common ports (Gibson is slated by experts but this works as as a rough guide)

the ones you dont want communicating out are 137,138,139 445 among others

these days decent routers contain excellent hardware firewalls that work on IP tables see link below for a Draytek explanation

http://www.draytek.co.uk/natmovie.html

in a sense by default they only allow information into your network that you request

pc's can be safe with software firewalls as long as they configured well, but id always prefer to be sitting behind a hardware one to be honest

edited again to add decent netstats are

netstat -b (programs)

netstat -an (source and destination ip, protocol and port)

Jza

Hey thanks mike thats great stuff - thanks for advice

I've ran the tests you mentioned and th pc passed

Jza