DSM-G600, DNS-3xx and NSA-220 Hack Forum

KRH wrote:

the webinterface is not secure if you relly need access to it ourside you need to have some firewalling done by your router.

Ok, so disable the web interface... My router is forwarding port 80. What else do I need to do other than disable the forwarding?

KRH wrote:

ftp ports are always scanned after open ports, and the build in ftp server is know for having open ports..

what do you mean by "know for having open ports"? Are you saying that the ftp is not secure enough to use? What else can I do other than limit the number of users and disable anonymous?

Last edited by fullcity (2007-10-06 23:43:18)

mig wrote:

You could try a network analyzer like wireshark http://www.wireshark.org/ to capture the traffic and determine what Ethernet activity you are seeing.

Wow, thanks! Great tool.

Any idea how I can use it to see if anyone is accessing my FTP?

Adam

fordem wrote:

Yes - use it to capture the traffic to/from the DNS-323 and then analyze it for ftp packets (port 20) - good luck.

Thanks! Having never used a sniffer can you give me a slight point in the right direction? What kind of things should I be looking for? If the DNS323 is wired to my router can I watch the traffic between it and my router using my laptop's wireless card as an interface? I assume not.

Thanks!

fullcity wrote:

fordem wrote:

Yes - use it to capture the traffic to/from the DNS-323 and then analyze it for ftp packets (port 20) - good luck.

Thanks! Having never used a sniffer can you give me a slight point in the right direction? What kind of things should I be looking for? If the DNS323 is wired to my router can I watch the traffic between it and my router using my laptop's wireless card as an interface? I assume not.

Thanks!

You assume correctly - and in fact - if your router is the typical consumer grade, firewall/router/wireless access point/4 port switch, then you'll need to connect a hub between DNS-323 and the router and connect the laptop there in order to sniff the traffic.

Attempting to explain how to use a sniffer and what to look for is not something that I would attempt using a forum such as this - it's too complex for text based communication - you'll have to grab the documentation and start reading.  Essentially what you need to do is to create a filter which allows only the traffic of interest to be captured - deciding what is of interest is critical to prevent being completely overwhelmed by the volume of data - in fact I would not consider using a sniffer as a means of providing security unless you can automate the analysis - which is essentially turning it into an Intrusion Detection System.