teste com nmap..

fala povo!
testei um firewall esses dias e gostaria de saber se os resultados são satisfatórios.. fiz apenas dois testes! só apareceu o pop que ainda vou ver como conserto isso..

se existirem ferramentas melhores de testes, me informem por favor!!

abraços!!

---

nmap -vv -P0 -O -sV -p1-1024 x.x.x.x

Initiating Parallel DNS resolution of 1 host. at 11:04
Completed Parallel DNS resolution of 1 host. at 11:04, 9.27s elapsed
Initiating SYN Stealth Scan at 11:04
Scanning www.umsite.com (x.x.x.x) [1024 ports]
SYN Stealth Scan Timing: About 14.65% done; ETC: 11:08 (0:02:58 remaining)
Completed SYN Stealth Scan at 11:08, 210.52s elapsed (1024 total ports)
Initiating Service scan at 11:08
Warning: OS detection for x.x.x.x will be MUCH less reliable because we did not find at least 1 open and 1 closed TCP port
Initiating OS detection (try #1) against www.umsite.com (x.x.x.x)
Host www.umsite.com (x.x.x.x) appears to be up ... good.
All 1024 scanned ports on www.umsite.com (x.x.x.x) are filtered
Too many fingerprints match this host to give specific OS details TCP/IP fingerprint by osscan system #2:
SCAN(V=4.20%D=6/7%OT=%CT=%CU=%PV=N%G=N%TM=46681152%P=i686-pc-windows-windows)
U1(R=N)
IE(R=N)

Nmap finished: 1 IP address (1 host up) scanned in 224.547 seconds
Raw packets sent: 2072 (93.448KB) | Rcvd: 0 (0B)


---

nmap -vv -P0 -sT -p1-1024 x.x.x.x

Initiating Parallel DNS resolution of 1 host. at 11:09
Completed Parallel DNS resolution of 1 host. at 11:09, 6.02s elapsed
Initiating Connect() Scan at 11:09
Scanning www.umsite.com (x.x.x.x) [1024 ports]
Connect() Scan Timing: About 7.08% done; ETC: 11:16 (0:06:39 remaining)
Discovered open port 110/tcp on x.x.x.x
Completed Connect() Scan at 11:15, 360.36s elapsed (1024 total ports)
Host www.umsite.com (x.x.x.x) appears to be up ... good.
Interesting ports on www.umsite.com (x.x.x.x):
Not shown: 1023 filtered ports
PORT STATE SERVICE
110/tcp open pop3

Nmap finished: 1 IP address (1 host up) scanned in 366.531 seconds

vc está com um dos melhores sninfer na mão ... o nmap é o cara,
para mais detalhes consulte seu manual,

Falow ...

IMHO, o negócio pode ser considerado seguro quando o NMAP nem encontra o host levantado. Tu pode utilizar algumas ferramentas como o PortSentry para evitar isso esse tipo de scanner. Fora isso, eu recomendo o Nessus (Que utiliza o NMAP) para verificar a segurança. Existem também distribuições em live-CD que fazem teste de penetração (Ui!) nos seus servidores.

Abraços!