full-disclosure - ICF scan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: nonleft at gmx.net (isa vaul)
Subject: ICF scan

Hi list,

This might not be the right place for it, but I thought maybe some of you 
guys had an explanation for the following. I was playing around with my XP 
box and scanned myself with the ICF in place and without.

ICF-scan:

* + 127.0.0.1
             |___   135  DCE endpoint resolution
             |___   389  Lightweight Directory Access Protocol
             |___  1720  h323hostcall
             |___  3001  Redwood Broker
             |___  3002  EXLM Agent

without:

* + 127.0.0.1
             |___   135  DCE endpoint resolution

So as I understand the functionality of ICF (default adjustments) it should 
prevent every connection towards my computer unless the connection has been 
established by a process on my side (ACK, SYN/ACK). But why there are more 
open ports with ICF than without?

Thanks for any suggestions in advance.

Kind Regards
Nonleft