This Internet Port Probe attempts to establish standard TCP Internet connections with a handful of standard, well-known, and often vulnerable Internet service ports on YOUR computer. Since this is being done from our server, successful connections demonstrate which of your ports are "open" or visible and soliciting connections from passing Internet port scanners.

If all of the tested ports were shown to have stealth status, then for all intents and purposes your computer doesn't exist to scanners on the Internet!

It means that either your computer is turned off or disconnected from the Net (which seems unlikely since you must be using it right now!) or an effective stealth firewall is blocking all unauthorized external contact with your computer. This means that it is completely opaque to random scans and direct assault. Even if this machine had previously been scanned and logged by a would-be intruder, a methodical return to this IP address will lead any attacker to believe that your machine is turned off, disconnected, or no longer exists. You couldn't ask for anything better.

There's one additional benefit: scanners are actually hurt by probing this machine! You may have noticed how slowly the probing proceeded. This was caused by your firewall! It was required, since your firewall is discarding the connection-attempt messages sent to your ports. A non-firewalled PC responds immediately that a connection is either refused or accepted, telling a scanner that it's found a live one ... and allowing it to get on with its scanning. But your firewall is acting like a black hole for TCP/IP packets! This means that it's necessary for a scanner to sit around and wait for the maximum round-trip time possible — across the entire Net, into your machine, and back again — before it can safely conclude that there's no computer at the other end. That's very cool.

"Closed" is the best you can hope for without a stealth firewall in place.

Anyone scanning past your IP address will immediately detect your PC, but "closed" ports will quickly refuse connection attempts. Your computer might still be crashed or compromised through a number of known TCP/IP stack vulnerabilities. Also, since it's much faster for a scanner to re-scan a machine that's known to exist, the presence of your machine might be logged for further scrutiny at a later time — for example, when a new TCP/IP stack vulnerability is discovered.

You should stay current with updates from your operating system vendor since new "exploits" are being continually discovered and they are first applied upon known-to-exist machines . . . like this one!

If one or more of your ports are shown as OPEN! then one of the following two situations must be true:

You have servers running on those open ports:

If your system is running Internet servers on the ports shown as OPEN, you should stay current with PC industry security bulletins. New security vulnerabilities are being found continually. When crackers learn of a new vulnerability, they quickly grab their scanner logs to search for systems that have been scanned in the past and are of the known-to-be-vulnerable type. This allows them to be attacking logged systems within moments of learning of a newly located security hole. It is therefore important for you to respond to any news of new vulnerabilities in your systems as quickly as possible. The crackers are hoping you'll take your time.

You DO NOT have servers running on those open ports:

If you are not actively offering Internet services through the ports shown as OPEN, something is very wrong with your system:

 

Logs of open ports are maintained by crackers and used as points of attack.

Either a server has been started without your knowledge — as is done by Trojan horse programs like Back Orifice — or you may be running one of the many "Evil Port Monitors" which has altered your system's "open port profile" in order to monitor TCP/IP connections. Evil Port Monitors will tell you that a passing scanner has just successfully probed into your system . . . but the problem (for you) is that it was a successful scan probe and the existence of your system's wide open ports will have been noticed and logged!

Your system may be monitored for Internet attacks without alerting crackers to your presence by using a real personal firewall product — instead of one of the many evil port monitors. For the best monitoring and protection I recommend ZoneLab's FREE firewall: ZoneAlarm 2.x. (See the "Personal Firewalls" page for more information.)