AW: drop policy- udp ports open?

["Dobersberger Dieter" <dieter.dobersberger@trench.at>]

> when i enter iptables -P INPUT DROP normally all ports should 
> be closed.
> but a portscan from http://www.sns.co.at/german/tools.htm 
> tells me that 
> all tcp ports are stealth, icmp is closed and all scanned upd 
> ports are 
> open.

Because UDP is a stateless protocol an UDP scan can not be 100%
accurate, because you can never know if your packet was received. You
can only know if it was rejected, because you get an ICMP
destination-unreachable packet back in that case. But if the packet was
droped by a firewall some portscanners assume it was received by the
destination host, because there is no negative answer.

So I would guess the scanner you are using is reporting the wrong ports
as open.

You should verify your results with an external host running nmap to be
sure.

best regards,
Dieter