2

While doing a review of my home network security from an external network, I noticed it was possible to discern the service running on port 99 (xrdp). When I got home I ran a nmap -A localhost and saw the same result.

Is it possible / practical to prevent service detection like this?

As I understand it, nmap is using a simple (but effective) database of returned bytestreams (or hashes thereof) to determine the service, so subversion of this may require meddling with the protocol itself, hence my question both on possibility and practicality.

1
  • IMHO it is not practical
    – Panther
    Commented Jul 24, 2018 at 17:22

2 Answers 2

Reset to default
1

Drawing on the answers given to this somewhat similar question and this one about OS detection, it seems that this is indeed possible (almost anything is possible), but is not likely to deliver a proportionate return on investment of your time - which is likely to be significant. Pages like A practical approach for defeating Nmap OS-Fingerprinting and projects like ippersonality have not been kept up to date, which may have provided a somewhat easier solution but perhaps there is good reason for these things (and similar ones) not being kept up to date.

It's a real pity because as I see it, a significant battle is won if a would-be hacker can't determine the OS or service that is living on a particular port. It seems that proxies, VPNs etc are all more generic and practical alternatives however.

0

Unfortunately, it is not possible. The only way to hide your services is making ports closed.

1
  • 1
    Could you expand on this at all? Do you have personal experience or have a reference that backs up what you're saying?
    – AlwaysTalkingAboutMyDog
    Commented Jul 25, 2018 at 4:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .