| Network security is the new buzz word around town. | | | | The netstat command will also show you who is |
| Most people think a network firewall that is setup with | | | | active on your computer. This willshow you what |
| the default will protecttheir network. The simple fact is | | | | spyware or trojan horses that may have installed on |
| no it will not. Not until you are hack willyou know this | | | | your machine. |
| fact. Of course this comes a little too late. All operating | | | | Active Connections |
| systemsneed ports open in order to communicate | | | | Proto Local Address Foreign Address State |
| information regarding active directory, | | | | TCP argonas:epmap argonas:0 LISTENING |
| DNS, DHCP, booting of a computer and more. Some | | | | TCP argonas:microsoft-ds argonas:0 LISTENING |
| applications need ports open towork. So where do | | | | TCP argonas:pptp argonas:0 LISTENING |
| you reach a safe point where your applications work | | | | TCP argonas:3389 argonas:0 LISTENING |
| and theyare secure. The following will address the | | | | TCP argonas:1026 argonas:0 LISTENING |
| working ports and what to beconcerned about. Later I | | | | TCP argonas:2617 localhost:2618 ESTABLISHED |
| will address how to secure it. | | | | TCP argonas:2618 localhost:2617 ESTABLISHED |
| Ports to be concerned about are 3389 which isterminal | | | | TCP argonas:2619 localhost:2620 ESTABLISHED |
| services ports. If you do not have a firewall in place | | | | TCP argonas:2620 localhost:2619 ESTABLISHED |
| blocking public | | | | TCP argonas:4664 argonas:0 LISTENING |
| IP address from forwarding to private IP address using | | | | TCP argonas:netbios-ssn argonas:0 LISTENING |
| this port then you willwant to call a security | | | | TCP argonas:2958 an-in-f104.google.com:http |
| professional right away. Other ports to be | | | | ESTABLISHED |
| concernedabout are 139 which gives access to | | | | TCP argonas:3011 va-in-f104.google.com:http |
| network shares. | | | | TIME_WAIT |
| Another area of concern is the SMB or the | | | | TCP argonas:3014 eo-in-f147.google.com:http |
| (Server Message Block) protocol. This protocol is used | | | | ESTABLISHED |
| among other things forfile sharing in Windows NT/2000 | | | | TCP argonas:3081 unknown.xeex.net:http TIME_WAIT |
| XP. In Windows NT it ran on top of NetBT | | | | TCP argonas:3104 unknown.xeex.net:http |
| (NetBIOS over TCP/IP), which used the famous ports | | | | ESTABLISHED |
| 137, 138 (UDP) and 139 (TCP). | | | | TCP argonas:3903 web1.allaboutsingles.com:http |
| In Windows 2000/XP/2003, Microsoft added the | | | | CLOSE_WAIT |
| possibility to run SMB directlyover TCP/IP, without the | | | | TCP argonas:4449 |
| extra layer of NetBT. For this they use TCP port 445. | | | | static-71-116-207-166.lsanca.dsl-w.verizon.net:pptp |
| Again all these ports should remain in the private | | | | ESTABLISHED |
| network and your firewallshould block access. | | | | TCP argonas:4762 va-in-f104.google.com:http |
| Note: The NETSTAT command will show | | | | CLOSE_WAIT |
| youwhatever ports are open or in use, but it is NOT a | | | | TCP argonas:netbios-ssn argonas:0 LISTENING |
| port scanning tool! If youwant to have your computer | | | | TCP argonas:2939 192.168.100.202:1025 ESTABLISHED |
| scanned for open ports see this page instead (linkwill | | | | TCP argonas:2957 exchange01.intercore.local:1419 |
| follow shortly). | | | | ESTABLISHED |
| C:>netstat -an |find /i "listening" | | | | Once you have locked down all ports then you must |
| TCP 0.0.0.0:135 0.0.0.0:0 LISTENING | | | | beconcerned with internal security. No one in your |
| TCP 0.0.0.0:445 0.0.0.0:0 LISTENING | | | | organization will be allowed totalk to anyone about any |
| TCP 0.0.0.0:1723 0.0.0.0:0 LISTENING | | | | secure information. Even giving out there emailaddress. |
| TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING | | | | Next use devices like honey pots, barracuda spam |
| TCP 127.0.0.1:1026 0.0.0.0:0 LISTENING | | | | appliance, Symantecanti-virus hardware and software. |
| TCP 127.0.0.1:4664 0.0.0.0:0 LISTENING | | | | A properly configured network can allow yourworkers |
| TCP 192.168.50.127:139 0.0.0.0:0 LISTENING | | | | to work and disallow hackers to work. |
| TCP 192.168.100.193:139 0.0.0.0:0 LISTENING | | | | |