Hello Technoslick,

Sunday, June 15, 2003, 7:31:07 AM, you wrote:

T> I have a Linksys router/gateway that has the ability to dynamically
T> open ports and port ranges when a certain executable is requesting
T> to do so from a network client. This has worked very well from
T> Windows clients using NetMeeting, ICQ or MSN Messenger for video
T> conferencing and chat sessions, respectively.

It might be that it only works with Netmeeting or other pgms that
specifically use that capability.

I was VERY interested in this idea because it opens up an entirely
different level of protection for the comps on the local net. Without
this, it is necessary to have a separate *app-aware* firewall on each
computer.

I found this on the net, as a starter:

--------

When Microsoft developed NetMeeting 3.0 they chose to use the existing
h.323 video conferencing protocol. This protocol happens to be
completely incompatible with standard NAT(network address translation)
- the technology used for most internet sharing devices.

Unlike most TCP/IP applications, NetMeeting uses DYNAMIC PORTS instead
of STATIC PORTS. That means that each NetMeeting connection is
somewhat different than the last. For instance, the HTTP web site
application uses port 80. NetMeeting can use any of over 60,000
different ports. Putting a web server behind a firewall means opening
a single small hole. Putting a NetMeeting computer behind a firewall
means opening over 60,000 ports - a security nightmare.

A few hardware manufacturers have taken it on themselves to actually
provide H.323 compatibility. This is not an easy task since the router
must search each incoming packet for signs that it might be a
netmeeting packet. This is a whole lot more work than a router
normally does and may actually be a weak point in the firewall.

--------

So - it does not seem to be generally useful, and introduced a new
batch of security problems. Too bad. It sounded good. :-)

-- 
Thank you,
 rikona                            mailto:[EMAIL PROTECTED]


Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com

Reply via email to