savrus / uguu

Automatically exported from code.google.com/p/uguu
Other
3 stars 1 forks source link

[Win32] ftp port scanning interacts with ALG service #18

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago
When trying to connect any:21, ALG intercepts connection. For connection
initiator it looks like succeeded connection.

I don't think this could be changed under python layer and there are only
two partial workarounds:
# try to talk with FTP server
# assume FTP servers as avaliable, don't wait (anyway, there are only small
amount of ftp servers as compared to samba servers)
The first workaround is too complex and overlaps with scantype_id
detection, latter makes no sense in coding due to mistaken scan results.

The complete fix is documenting the conflict with ALG service, so
administrator will have to disable it during scans or completely.

Original issue reported on code.google.com by radist...@gmail.com on 8 Feb 2010 at 3:20

GoogleCodeExporter commented 9 years ago
+++
another Win32 issue: limit number of half-open ports.
Whether patch TCPIP.SYS, or significantly decrease max_connections.

Original comment by radist...@gmail.com on 8 Feb 2010 at 3:59

GoogleCodeExporter commented 9 years ago
+++
registry issue: AFAIR, parameters TcpTimedWaitDelay and MaxUserPort at key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters could 
affect
connectivity. Former defines how long system keeps released ports in TIME_WAIT 
state
and the latter limits ports for ongoing connections. For example, due to small 
amount
of available ports for ongoing connection and long TIME_WAIT interval (by 
default),
scanning ftp server with too many folders without STAT command could fail 
(depending
on mode, ongoing port will end on scanner's or even on ftp-server's machine 
(for some
servers).

Original comment by radist...@gmail.com on 11 Feb 2010 at 2:54