port 0 and 1026

Logla · Feb 18, 2004, 07:17 PM

Any idea why I can't stealth port 1026 on my router? Port 0 can't be stealthed because as far as the router is concerned, port 0 doesn't exist so it just refuses any pings, but 1026 has me baffled - Shields up says that 1026 is closed and if I try to port forward 1026, I get an error saying duplicate port.

PangingJr · Feb 18, 2004, 10:01 PM

Software firewall will help blocking all incoming connection requests on the port, most of them will do it automatically.

zerodamage · Feb 18, 2004, 10:16 PM

I am thinking that your firewall is using port 1026 for something. Test by disabling certain Firewall features and what not. That is the only way this would be showing as closed versus stealth.

The_Neon_Cowboy · Feb 18, 2004, 10:40 PM

just goto run, type "command" (hit) enter
then type netstat it'll show all active connections to your pc
if there is sevral make sure you check for spyware

Logla · Feb 19, 2004, 07:27 AM

Tis the firewall that is using 1026 although I'm not sure what. Going to use a software firewall to try to stealth that one.
thanks guys

Judas · Feb 19, 2004, 11:02 AM

.....what kind of router?

zerodamage · Feb 19, 2004, 11:07 AM

Follow Neon's advice and do a scan for spyware. There may be spyware holding open that port. 1026......

I also checked GRC.com and this is the information available about port 1026. http://grc.com/port_1026.htm

I think using up resources just for the one port being stealthed is silly. I would check for firmware updates on your router and also check for spyware and make sure you are not running any software that could be using that port.

Another thing to try is forward that port to a non existent IP address on your LAN. This should result in a dropped packet which will result in it showing as Stealth. But read that description over really well in the link above, this may be the key right here:

Quote:

If you are reading this page because our port analysis has revealed that you have open ports lying between 1024 and 1030, it would certainly be in your best interests to configure your personal firewall to block incoming connection requests (TCP SYN packets) to those low-numbered ports.

Logla · Feb 19, 2004, 11:07 AM

Its an old netgear MR314 - I think its about 2 years old as I got it really cheap from the local store which had a clearance sale.

I tried to install a software firewall but this made no difference - which I suppose it wouldnt really as shields up! will be probing the ip address assigned to the router as opposed to by the router.

zerodamage · Feb 19, 2004, 11:12 AM

No, the port probe doesn't know the IP address of your computer on the LAN. It only knows the IP address of the router itself. So if this port is showing as closed, then your firewall is either forwarding it to your box and your system has it closed or the Router is using that port for something.

I think it may be your old netgear router. They are not very good.

Judas · Feb 19, 2004, 11:16 AM

....D-Link has some rather cheap and great routers.... i have a DI-704P...... the 604's are reall good though..... i think i saw a 604 for for under $70 canadian... and my 704 went for just over the $100

PangingJr · Feb 19, 2004, 01:25 PM

Hmm usually the software FW should block that port when getting a probe.
it'll be the hard way, check out this article - http://www.hsc.fr/ressources/breves/...es_win.en.html
in there you'll find the way to identify which RPC services (Messenger service, Task Scheduler, etc..) is using TCP/UDP 1026 ports,
scroll down the page to the 'Disabling unused services', if you can find out what windows service that uses the port and you can disble it since its no used for you then the port will be closed. also read the 'Warning' that tells about the 'netstat' command misleading informations on XP, also take a closer look at the 'rpcdump tool'

krazy1 · Feb 19, 2004, 01:33 PM

Quote:

Originally posted by panging
Hmm usually the software FW should block that port when getting a probe.
it'll be the hard way, check out this article - http://www.hsc.fr/ressources/breves/...es_win.en.html
in there you'll find the way to identify which RPC services (Messenger service, Task Scheduler, etc..) is using TCP/UDP 1026 ports,
scroll down the page to the 'Disabling unused services', if you can find out what windows service that uses the port and you can disble it since its no used for you then the port will be closed. also read the 'Warning' that tells about the 'netstat' command misleading informations on XP, also take a closer look at the 'rpcdump tool'

The Software would only catch it if his port was open on the hardware. It is closed and he wants it stealth..... If he opened the port on the hardware then the software would catch it but if it isn't open on the hardware then the software won't do anyting. For some reason some of the hardware firewalls have ports that are closed and not stealthed. The latest Maximum PC had a review on some hardware firewalls and the Linksys they reviewed had a port that was closed and not stealth. I don't remember which port is was... the magazine is at home. I think you will be fine with just the hardware. I had a linksys firewall for 3 years with one port showing closed and not stealthed and I was fine.

blade5545 · Feb 19, 2004, 01:41 PM

I think the port that krazy1 is talking about is port 139 by default a lot of routers have it close but not stelthed but there is a way to make it stealth just forward port 139 to an ip address that does not exist on your home network like 192.168.1.255 and it will show up as stealth.

PangingJr · Feb 19, 2004, 02:02 PM

read the info again on the GRC.com links that Zerodamage posted

Logla · Feb 19, 2004, 02:16 PM

Quote:

Originally posted by zerodamage
No, the port probe doesn't know the IP address of your computer on the LAN. It only knows the IP address of the router itself. So if this port is showing as closed, then your firewall is either forwarding it to your box and your system has it closed or the Router is using that port for something.

I think it may be your old netgear router. They are not very good.

I think you are probably right on that one. Even If I setup the port forwarding for all the ports I can only some of them show as stealthed for some of the time. I can rerun the test and get slightly differing results. Some show closed, some stealthed.

This router did a wierd thing at the beggining of this week when it started rebooting whenever the internet and another pc were connected to it. I had to completley reset the router and set it up again from scratch using a different channel for the wireless.

I'm tempted to return it to the store as I've only had it 2 weeks and it has been playing up a little. I would probably (I hope) get a full refund. Can anyone reccomend a really good router? Wireless would be nice but not essential.