UNIX for Dummies Questions & Answers

An nmap with a UDP option always shows open ports as filtered when u perform it over a range of ports .
When u perform it on a per - port basis it gives it as open
If thats a bug with nmap , I am not sure ...
But thats how it is .
UDP Scanning filtered <=> open

DP

Well, the results you first posted above, it looks like you ran a TCP scan, not a UDP one. If you did run a UDP scan, then yes, I suppose nmap could assume it was filtered, since UDP is connectionless, and won't reply. It will only show as closed the ports that receive an ICMP Unreachable (I think) message.

I hate to suggest this, but maybe you should boot from floppy or CD, and run the tools from CD or another filesystem. You may have been rooted and had trojan horses installed that will filter itself out of ps, top, netstat, and other tools. Also, you might check chkrootkit (http://www.chkrootkit.org/). It recognizes many trojans.

Has your Redhat 6.2 been patched? Default 6.2 has plenty of exploitable problems by default in it (ftpd, telnetd, sshd, lpd, etc...). Also, have you tried connecting to any of these ports to see if they provide a banner or possibly even a shell? (I doubt they will though, if nmap shows them as filtered).

If you do turn out to be trojaned, you should wipe your disk clean and reinstall from CD. You may be able to clean up after the rootkit, but you don't know what else has been done.

Please post back and let us know what's going on...

I tried to scan again using 'knocker' from a machine which i believe is not being compromised. This time, knocker can only find one port, SSH, opened, which is what i expected. From the same machine nmap results still show that these 4 ports are still in 'filtered' state. Is it a bug or something with nmap?

Pls advise me on the vulnerabilities of RH6.2. My boxes have not been patched.

I don't know all of them; I have upgraded my home machine to RH 7.2.
Check here: http://www.redhat.com/support/errata...a-general.html
By the looks of it, you have a bit of work to do!
Keep in mind, though, that not all of those are critical, and even a few of the really important ones are for applications you probably don't use. In that case, I usually just uninstall it rather than expose a security risk or upgrade software I don't want / need.