Re: Data Interpretation

["Michael Painter" <tvhawaii () shaka com>]

----- Original Message ----- 
From: "Michael Lynch" <mlynch1212 () msn com>
To: <security-basics () securityfocus com>
Sent: Monday, March 16, 2009 10:27 AM
Subject: Data Interpretation



Hello,

First of all let me start by saying that
I have 4 days of experience with nmap

Last week a friend suggested that I download
and try nmap, at his suggestion I tried nmap
and found it very interesting.
After installation I tried a scan on a Linux computer
that I have, to test it out.
I found a few results that caught my eye, but I
cannot correctly interpret the results.
Could someone help me with the interpretation?



Here is what is in question!

Port  Protocol  State     Service

12345 tcp       filtered  netbus
27374 tcp       filtered  subseven
31337 tcp       filtered  Elite


Here is the command that I used:
nmap -PE -v -p1-65535 -PA21,23,80,3389 -A -T4 xxx.xxx.xxx.xxx  (XXX.= my IP address)

I initiated this scan using the Zenmap GUI

I know that all the services listed here are backdoor style breaches,
but does this mean that the machine has been infected by these or
that there has been an attempted attack with these?
Could someone please help me with this?


Thanks in advance,
Michael
------------------------------------------------------------------------
> From Port Scanning Basics
http://nmap.org/book/man-port-scanning-basics.html

filtered
Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. The 
filtering could be from a dedicated firewall device, router rules, or host-based firewall software.


------------------------------------------------------------------------
This list is sponsored by: InfoSec Institute

Find the source of cybercrime! Almost every crime today involves a computer or mobile device. Learn how to become a Computer Forensics Examiner in InfoSec Institute's hands-on Computer Forensics Course. Up to three industry recognized certs available, online computer forensics training available. 

http://www.infosecinstitute.com/courses/computer_forensics_training.html
------------------------------------------------------------------------