comp.security.firewalls archive
Re: Q: How do stealth ports manage to accept a connection?
Date: Tue Jan 31 2006 - 20:00:01 CET
On 31 Jan 2006 03:19:52 -0800, Entropy1024@gmail.com wrote:
> My question is how does an FTP server running on my local lan manages
> to accept a connection to a client if the port is in stealth mode?
It doesn't. Period. A port must be "open" to accept connections. In
other words, it must respond to a SYN with a SYN/ACK as part of a
normal three-way handshake as described in the RFC that specifies TCP.
A "closed" port responds to a SYN with an RST. In other words, the RST
reply signals that the port is not accepting connections.
A "stealth" port is, as far as I can tell, an invented term made up by
Steve Gibson. It refers to a port that doesn't reply at all to a
connection attempt. You won't find the word stealth mentioned in any
of the RFCs except in the context of stealth DNS servers. It's best to
avoid these Gibsonisms and stick to standard terminology.
Received on Tue Feb 7 20:58:33 2006