Unit 4: TCP, UDP and ports · Lesson 4 of 6 · 18 min
Open, closed and filtered
Read a server's three possible answers to a SYN and what each one tells a defender.
mission
- You are
- The analyst reviewing internal traffic.
- Situation
- During an investigation, laptop-mchen (10.10.0.44) sent SYNs to web01 on three ports. The packets are in incident.pcap.
- Goal
- Classify each port as open, closed or filtered from web01's replies.
- Hand in
- The port that got no reply and how many times the laptop tried it.
Ports as doors
List the SYNs to web01
Filter on SYNs without ACK sent to one address. Retransmissions are marked: the sender tried again because nothing came back.
tshark -r incident.pcap -Y 'ip.dst==10.20.0.11 && tcp.flags.syn==1 && tcp.flags.ack==0'
224 480.011259 10.10.0.44 → 10.20.0.11 TCP 54 59954 → 22 [SYN] Seq=0 Win=64240 Len=0
227 480.036128 10.10.0.44 → 10.20.0.11 TCP 54 59241 → 445 [SYN] Seq=0 Win=64240 Len=0
228 480.064721 10.10.0.44 → 10.20.0.11 TCP 54 50405 → 3389 [SYN] Seq=0 Win=64240 Len=0
255 481.036128 10.10.0.44 → 10.20.0.11 TCP 54 [TCP Retransmission] 59241 → 445 [SYN] Seq=0 Win=64240 Len=0
256 483.036128 10.10.0.44 → 10.20.0.11 TCP 54 [TCP Retransmission] 59241 → 445 [SYN] Seq=0 Win=64240 Len=0
you should see Port 445 was tried three times.
List web01's answers
Now the other direction. Each port that answered appears here; a filtered one does not.
tshark -r incident.pcap -Y 'ip.src==10.20.0.11 && ip.dst==10.10.0.44'
225 480.011659 10.20.0.11 → 10.10.0.44 TCP 54 22 → 59954 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0
229 480.065121 10.20.0.11 → 10.10.0.44 TCP 54 3389 → 50405 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
you should see 22 is open, 3389 is closed and 445 is filtered.
Three answers to a SYN
- SYN-ACKopen: a program is listening
- RST, ACKclosed: the host is there, nothing listens
- no reply, retriesfiltered: a firewall dropped it silently
Find every retransmission
tshark's analysis flags mark repeated packets. In a sweep, they point straight at filtered ports.
tshark -r incident.pcap -Y 'tcp.analysis.retransmission' -T fields -e frame.number -e ip.dst -e tcp.dstport
255 10.20.0.11 445
256 10.20.0.11 445
you should see Only one port anywhere in the capture was dropped.
defender tip A closed port that answers RST still tells a scanner the host exists. Dropping silently gives away less, which is why firewalls usually drop.
Count each answer in the port scan
Apply the same reading to the scan of web01: resets mean closed, SYN-ACKs mean open.
tshark -r scan.pcap -Y 'ip.src==10.20.0.11 && tcp.flags.reset==1' | wc -l 96 tshark -r scan.pcap -Y 'ip.src==10.20.0.11 && tcp.flags.syn==1 && tcp.flags.ack==1 && ip.dst==203.0.113.50' | wc -l 4
you should see 96 closed answers and 4 open ones.
What a defender takes away
- 1SYN-ACK means open, RST means closed, silence means filtered.
- 2Retransmitted SYNs are the footprint of a firewall drop.
- 3A laptop knocking on server ports it never uses is a lead worth following.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.