Subj : Port Blocking
To   : Stewart Buckingham
From : Bob Jones
Date : Fri Apr 05 2002 02:09 am

 SB> This is what I had from the netstat -s command
 SB> --------------------------------------------------------------------------
 SB>                               AF_INET Address Family:
 SB>                               Total Number of sockets 5

 SB>   SOCK   TYPE       FOREIGN          LOCAL         FOREIGN         STATE
 SB>                      PORT             PORT            HOST
 SB> ======  =====      ==========      ==========      ==========    ========
 SB>      1 STREAM               0               0         0.0.0.0  CLOSED
 SB>      2    RAW               0               0         0.0.0.0  RAW
 SB>     92 STREAM              22           58737    xxx.x.xxx.xx  ESTABLISH
 SB>    100 STREAM         ftp..21           58741    xxx.x.xxx.xx  ESTABLISH
 SB>   2119  DGRAM               0               0         0.0.0.0  UDP

 SB> The 2 ESTABLISH Local Ports were because I was FTP'ing 

Yes, the foreign ports of 21 and 22 are the FTP connection you had opened.  I 
find the "RAW" state interesting, along with the UDP state  entries.  What bugs 
me is both of those are listed as PORT 0 for both your end and the remote end, 
along with a line showing local port 0 with a closed stated.  These three 
entries are probably left over in the system table from some prior IP 
connection.

Most likely you are ok.  It would be interesting to see this output right after 
you establish your internet connection.

You don't have any LISTEN ports,  so you don't have any TCP services open as 
far as I can tell.  I would have not been supprised if a UDP port was up on a 
standard port, but I don't see any such entries.  [Port 0 isn't supposed to be 
a "live" port....]  

> Also,  check your network configuration to make sure 
> you don't have netbios
> over TCP/IP enabled, or other similar tricks.....

 SB> My only network configuration is to enable TCP/IP Dial-Up (no LAN TCP/IP).

Then from what I see, you are in pretty good shape.  Yes,  you can probably get 
hit with DOS attacks, but any system on the internet can have that happen.  And 
concerning fragmented IP packets, if you have applied the appropriate fixes, 
then that shouldn't cause problems either.  Being on a dial upp line, I assume 
you have a dynamic IP address.  In that case, DOS and such stuff should be less 
likely than a full time network connection.

 SB> Stu/2

Take care.....

Bob Jones, 1:343/41

--- Maximus/2 3.01
 * Origin: Top Hat 2 BBS (1:343/41)

.