Step-by-Step: Creating a Wireless Network – Part 2

Step-by-Step: Creating a Wireless Network – Part 2

By Aaron Weiss

August 7, 2006

In Part 1 of “Creating a Wireless Network” we considered which equipment you’d need to meet your goals for speed, range, and security. Gear in hand, let’s set up the hardware and walk through a few simple configuration steps to bring your wireless network to life.

For the purpose of this guide, let’s assume you have two pieces of wireless gear: a wireless broadband router and a portable computer with wireless capability. If your portable computer does not have built-in wireless, you may use either a wireless card or USB adapter as described in Part 1. In either case, follow the manufacturer’s instructions for installing the device drivers that came with the hardware.

Step 1: Get To Know Your Wireless Router

Figure 1.

On the rear of a typical wireless router you’ll see several connections (from right to left in Figure 1):

• A power input jack one.
• One or more wired Ethernet jacks (often labeled 1, 2, 3, 4) for computers on your network which don't have wireless ability.
• One Ethernet jack for your broadband connection, often labeled “WAN” or “Internet.”
• A reset button. On most routers you can depress this button for 30+ seconds to restore all configuration settings to their factory defaults.

Depending on the model, some wireless routers will also have a small switch on the back to physically enable or disable the wireless network. You should verify that this switch is set to "on" to use the wireless functionality.

Some costlier routers may also feature two Ethernet inputs for two incoming broadband connections, for users who have both cable and DSL, for example.

Step 2: Determine Your Broadband Type

If you are not connecting your wireless router to a broadband connection, and only intend to use wireless networking for your local network rather than connecting to the Internet, skip this section.

Most people will connect their wireless router to an incoming broadband service. You need to know how your broadband service lets you onto its network, information we'll use in Step 5 to configure your router. There are three common broadband connection methods:

• DHCP aka Dynamic IP : The most common type of broadband connection, especially for cable modem users. Basic network parameters are automatically assigned to your router by the broadband modem.
• PPPoE: An increasingly common connection type, especially for DSL users in some parts of the country. PPPoE requires you to supply a username and password to initiate your broadband connection, information which should have been provided to you when your broadband service was installed or purchased.
• Static IP: Less common for home residential users, somewhat more common for business broadband. Your broadband provider would have supplied you with a set of numeric addresses you need to connect to the network, as they are not assigned automatically.

If you don't know which of the above your broadband service uses, when we setup your router you can try DHCP, since it is fully automatic. Should that fail to connect, you may contact your broadband provider for details.

Step 3: Connect Your Router To a Wired PC For Initial Setup

Figure 2.

Before you place the router in its ideal location, we will first set things up with a temporary wired connection to a computer. Either a desktop PC or portable computer with an Ethernet jack will do, although hooking up to a portable may require less climbing behind or under furniture.

3A. Your router probably included an Ethernet cable in the box. Use this or another Ethernet cable you have to connect the network jack on your computer to one of the local ports on the router – those labeled 1, 2, and so on. It doesn’t matter which, as long as you do not connect the cable to your router’s “WAN”/”Internet” port.

Also connect the Ethernet cable from your broadband modem to the "WAN"/"Internet" port on your router.

Now your router is connected via cable to both your broadband modem and your computer.

3B. It often helps to reboot your broadband modem at this point -- the easiest way is to unplug it from power and plug it back in. Most broadband modems will take a little while to reboot, anywhere from a few seconds to a couple of minutes.

Boot (or reboot) your computer as well.

Step 4: Open Web Browser and Connect to Wireless Router Administration Interface

You manage and configure your wireless router using a Web browser. To connect to your router you need to know its default IP address and connect your browser to http://routeripaddress. For example, if you own a Linksys brand wireless router, its default IP address is 192.168.1.1, and therefore you open your browser to the URL http://192.168.1.1.

Most wireless routers also require you to log in to access configuration pages. Quite likely, your router includes a manual or a "quick setup" guide which details both its default IP address and default login. Some common IP addresses and logins for popular brands include:

Brand	Default Address	Default Username	Default Password
Belkin	192.168.2.1
D-Link	192.168.0.1	admin
Linksys	192.168.1.1	or admin	admin or
Netgear	192.168.0.1	admin	password
SMC	192.168.2.1		smcadmin
Zyxel	192.168.1.1	admin or	1234

Figure 3.

Note that means to leave the field blank. These defaults describe many models in a vendor's lineup, but may not be accurate for certain exceptions or new models released after publication. Again, the documentation included with your router should clearly describe its default IP address and login.

Once connected, you'll see an administration interface similar to that in Figure 3, which was taken from a Zyxel brand wireless router. Your particular router's interface may look different and feature different menus, but many of the most important settings are similar between models and brands. Consult your documentation, of course.

Step 5: Configure Your Broadband Connection

You may recall way back in Step 2 you determined the type of broadband connection you have. Now it's time to setup the router accordingly. On this model, we clicked the "Basic" menu and "WAN" submenu. Again, your model may differ, and newer models may include a guided wizard that takes you through these steps. Users without a broadband connection can likewise skip this step.

Figure 4.

In our case, we have a broadband connection of the DHCP variety, also known as "Dynamic IP" as you see in Figure 4.

PPPoE users should click that button and a prompt will request your login name and password, as supplied by your service provider.

Static IP users will be prompted to supply several numerical addresses, also supplied by your service provider.

It's important to click "Save Settings" (sometimes called "Apply Settings") whenever you make a change.

Test that your router is successfully connected to your broadband. One quick way is to simply open a page to a Web site, such running a search at Google.

If you cannot access the Web, the most common cause is choosing the wrong broadband connection type for your service.

Step 6: Configure Your Wireless Network Basics

If your router is connected to broadband and it's working successfully, we can (finally!) setup the wireless networking configuration. On our sample router we clicked the "Wireless" submenu.

Figure 5.

It sounds simple, but note that the router reports that the wireless radio is on. Without that we would get nowhere. This particular router has a physical switch on the back to enable the wireless function. Other routers will include a checkbox in this administration interface for enabling or disabling all wireless function. Some wireless routers come out-of-the-box with their wireless disabled, others enabled. So it's important to double check.

Assign your wireless network a name, also known as an SSID. Choose a unique name in case there may be neighboring wireless routers nearby.

The visibility status setting is sometimes known on other routers as "hidden" mode. Some people mistakenly believe that hiding your network name is an effective form of security. It is not. You don't need to hide your network name.

Figure 6.

Also note the 802.11 mode setting, typically found on "g" variety wireless routers. Here you can tell the wireless router to connect only to devices which support the faster "g" mode, only the slower "b" mode, or either kind of device. Supporting both modes will make your wireless network more compatible with a variety of users. But if you know that you have only "g" wireless hardware in your network, selecting g-only mode can improve overall wireless performance.

Step 7: Configure Your Wireless Security

Figure 7.

In most circumstances you should employ encryption to protect your wireless network from all manner of attack and interception. Wireless networks located far removed from other people, like rural locations, probably don't run much risk without using wireless security. But we're often better safe than sorry.

Most wireless network users will select one of three common forms of secure encryption: WEP, WPA, or WPA2. As a general rule of thumb, you should only use the older, less secure WEP security when you know your network must support users with only WEP-capable computers. WPA is stronger than WEP and supports a wide variety of computers. WPA2, the newest form of wireless security, is even stronger still, but supports only the newest wireless computers.

7a. If you must use WEP security, try to choose a key length of 128 bits. If your router or wireless computer do not support 128 bit keys, you can try 64 or 40-bit keys, but note that these are even less secure.

Supply a passphrase for your WEP encryption. Later you'll need to use this same passphrase when configuring WEP on your wireless computer connection. Typically you can leave the remaining WEP options unchanged.

Figure 8.

7b. Choose WPA2 encryption if supported by your wireless computers. Our particular router offers a mixed WPA mode which will connect to WPA2 where available or else try WPA. Your router may or may not offer this feature, in which case you may need to select WPA mode if your network users may use hardware which does not support WPA2.

Your "Pre-Shared Key" is your WPA password. It must be longer than 8 characters up to 63. A longer, more difficult to guess key provides stronger security, but you must write it down somewhere safe because all connecting computers must use this password key.

Step 8: Going Wireless

Figure 9.

With the above configurations saved you're now ready to put the "wireless" in "wireless network." Choose the computer you will use to make the wireless connection. If you'll use the same computer you've been using to configure your router with the temporary Ethernet cable, remove that cable now.

If your portable computer is a newer model and includes built-in wireless support, be sure its wireless feature is switched on. On some portable models there is a switch on one side; on other models you enable wireless with a keyboard combination -- check your user manual.

If you've added wireless hardware to a portable computer or a desktop PC, be sure to follow the manufacturer's instructions for installing the appropriate drivers and software. This process varies widely from model to model.

Figure 10.

Both Mac OS X and Windows XP include built-in software for connecting your wireless computer to the wireless network. Windows users may also have installed software provided by the vendor of your wireless hardware which can be used instead of Windows' included software.

8a. Users of Mac OS X enjoy the easiest wireless connection process. Simply click the wireless icon at the top right of your screen and the drop down menu displays a list of available wireless networks. Choose one to join it. If you've secured your wireless network in Step 7, it will show a small lock beside its name, and the Mac will prompt you for the password key you created on the wireless router. (See Figure 9.)

8b. Windows users will see a wireless system icon in the lower right of the screen. You can right-click this icon to pop open a menu from which you select "View Available Wireless Networks." (See Figure 10.)

Figure 11.

Windows will open a summary showing the wireless network you created on your router -- and any other wireless networks your hardware sees in the vicinity!

In Figure 11, Windows sees the one wireless network transmitted from our router. As indicated, it is protected with WPA security.

Click the "Connect" button and Windows will prompt for the password key you created in Step 7.

If you are using your wireless hardware vendor's software rather than Windows', it may look different -- for example, Netgear supplies their own connection software with some models. In Figure 12, we use Netgear's wireless connection software to connect to a 128-bit WEP-protected network.

Whatever wireless connection software you use, the end result should be the same: you're connected!

Figure 12.

You should now be able to access the Internet, if your router is connected to broadband, and share resources among your computers the same as on a wired network.

Your wireless network will perform best with a strong signal. Ideally, find a location for your wireless router which is far from dense obstructions. Where possible, locating your wireless router in a higher location (such as a second story) is preferred to a low location like a basement.

In part three we'll take a closer look at fine tuning your wireless network performance and troubleshooting connection problems.

Creating a Wireless Network - Part 1

It’s no secret by now that wireless networking is quickly replacing tangled messes of cables in many homes and small businesses. No more fishing wires through walls, no more tripping over wires laid across doorways, and no more yelling at Fido or Fluffy when think Ethernet cables are chew toys.

What people love most about wireless networking, though, is the freedom it offers to share files between a computer in your office and one in your lap out on the patio, or to surf the Internet from bed. But with that explosion comes an avalanche of choices and technologies that can quickly become overwhelming. The good news is that putting together a wireless network can be simple. The key is to assess your needs, acquire the right equipment, and proceed through a few basic steps.
Step 1: Determine Your Needs and Set Your Goals

Wireless networking equipment is not all created equal, in part because different users have different needs. Think of a wireless network as having three primary personality traits: speed, range and security. Depending on your situation, you may want a network with all three or you may need a network strong in only one or two.

Consider these hypothetical scenarios:

A typical city dweller. You simply want to surf the Web and check e-mail using your portable computer around your apartment in the city. In this scenario, neither speed nor range need be best in class, but security is important because you are close to neighbors whose computers could pick up your signal.

A typical country dweller. You also just browse Web sites and log in to e-mail but your house is large, you have lots of land, and your neighbors are spread far and wide. You want Internet access from the backyard so range is important, but you may not need the most speed or the strongest security.

A business. You may need it all – speed for moving large documents around your network quickly, good range for providing access to users spread throughout several rooms or floors, and strong security to lock down your communications and prevent sensitive information from being compromised.

As you might expect, there is some correlation between price and performance when it comes to wireless networking equipment. Although prices continue to fall, considering your needs first will not only help you choose the right gear, but perhaps save you some money in the process.
Step 2: Choose Your Speed

Faster is better, right? It can be, and more speed certainly can’t hurt. But, like pumping premium octane fuel into a budget car, buying more wireless speed may mean paying extra for something you don’t really need.

There are two official wireless technologies you will typically find walking into any major name electronics depot: 802.11b and 802.11g. Often these are simply referred to as “b” and “g” respectively.

Packaging for an 802.11g 54Mbps wireless router

Wireless “b” gear is rated to 11Mbps while “g” gear is rated to 54Mbps. You may see these figures promoted on the packaging.

Newer technology is being added to wireless equipment to support even higher speeds such as 108Mbps and, most recently, 300Mbps. But these premium-priced devices are not yet based on official standards, meaning they may be compatible only with specific models from the same vendor, and future compatibility is unknown.

Don’t Be Fooled By Marketing Claims:

- The top speed your wireless network will achieve is half the advertised speed rating. A “b” network tops out at 5.5Mbps, a “g” network at about 27Mbps, and so on. Your real world speeds may be even lower due to wireless interference.

- “Mbps” does not mean “megabytes per second” but rather “megabits per second.” In real world terms, 1Mbps equals approximately a 122 Kilobytes/sec data transfer rate.

- A faster wireless network will not necessarily improve your Internet experience. You will be able to share files between your own computers as fast as your wireless network will allow, but your Internet download speed is limited by your broadband service. Most broadband service available in the U.S. today ranges from 0.5-10Mbps, or faster in some exceptional cases.
Step 3: Know Your Range

A strong wireless signal will let you achieve the fastest speeds your wireless network supports. As the signal weakens due to interference or distance, your speed will slow down accordingly.

The typical advertised range for most wireless network gear is 300 feet. In practice you could achieve significantly less range depending where you use the equipment. Dense obstacles such as walls, steel and trees will reduce your range. Interference from certain cordless phones and microwave ovens can also affect wireless network performance.

Significant improvements in wireless range are now available with higher-priced MIMO technology, which is used in model names including XR, RangeMax, and RangeBooster. These devices use multiple antennas (some hidden inside) to achieve greater range but performance can be unreliable if you mix and match hardware from different vendors.
Step 4: Evaluate Your Security Needs

Wireless network security is a hot topic in the media and for good reason – too often people leave their networks vulnerable. Because wireless data is just that – wireless – there can be ample opportunity for outsiders to sneak onto your network. Their actions may be harmless if they simply ride your Internet connection to check their e-mail, or they could attempt to steal passwords and other sensitive data.

Later we’ll setup wireless security, but first you need to decide how strong your hardware needs to be. The best forms of security rely on encryption so that if someone does intercept your data, they can’t make heads or tails of it. But some encryption is better than others – there are four degrees of encryption security available in wireless hardware today:

1. WEP: The oldest and least secure data encryption. All wireless gear supports WEP, though, so it’s useful when you need at least some kind of encryption to be compatible with older wireless hardware.
2. WPA: A more secure upgrade to WEP. Designed so that many older devices which included only WEP can be upgraded to support WPA.
3. WPA2: A significantly more secure upgrade to either WEP or WPA. Cannot upgrade older hardware to WPA2, but many new wireless devices support WPA2.
4. VPN: Short for “Virtual Private Networking,” this technology is not specifically a form of wireless network security. But you can use VPN on your wireless technology if you want the highest form of security possible. Wireless routers with VPN technology tend to be among the more expensive options.

Typically you’d use WPA (or WEP as a last resort) when your wireless security needs to be compatible with users who may have older wireless hardware. WPA2 support is the best choice when buying all-new wireless hardware, and VPN is more often found in high-security business environments.
Step 5: Choose Your Hardware

It takes two to tango, not only on the dance floor, but with your wireless network. Any wireless network is comprised of at least two devices: a wireless access point, which transmits the signal, and a client (your portable or other computer), which receives the signal.
5a. Wireless Access Point

A wireless broadband routerThe wireless access point transmits the networking data your computers will receive. These days, most wireless access points are actually built-in to "wireless broadband routers," devices that let you share a high-speed Internet connection among several computers and provide security defense. Readily available at major electronics retailers, you can easily identify a broadband router with a wireless access point because it has at least one antenna, although some have two or more.

Some broadband providers, such as Verizon, may include a wireless router with your service — so you might already have one. If not, current prices for routers with wireless access points range from as low as $25 to as high as several hundred depending on features, particularly the big three: speed, range, and security.
5b. Wireless Client

The wireless client is hardware, which “sees” the wireless networking data being transmitted by your access point. Most new portable computers include wireless client hardware already built-in. If you have an older portable computer without wireless support, or a desktop PC, you can add wireless client hardware. You have three choices:
A wireless card (for portable computers). Wireless cards look like credit cards, but slightly larger, often with a bump on one end. These slide into one of the card slots often found on the side of your portable computer. Wireless client card for portable computer
A USB peripheral. USB wireless clients come in a few shapes and sizes. One is a small box with a cable that plugs into one of your USB ports. Another is a “stick” shape which simply protrudes from a USB port. You can use a USB wireless client with most portable or desktop PC’s. Portable computer owners often prefer wireless cards instead because they slip almost completely into the machine. For desktop PC’s, a USB wireless client is the easiest solution to install. USB Wireless client"Stick" style USB wireless client
A PCI card (for desktop PC’s). A PCI wireless client is a circuit board that is installed inside your desktop PC. It will probably have a small antenna that sticks up outside your PC case. Some PC owners prefer a PCI wireless client for its “cleaner” installed look, and a wider range of models with different price/feature points than USB devices. However, installing a PCI card requires some work inside the PC case or else paying extra and hauling your PC to the electronics store. PCI wireless client card

For maximum performance you should choose a wireless router and client which support the same technologies. For example, if you want a “g” network, both devices must support the “g” standard. If you want special non-standard features such as support for 108 or 300Mbps speed and MIMO extended range, consider buying all wireless hardware from the same manufacturer.

In our next installment we set up your new wireless equipment, configure as needed, and fire it up!

Minimizing Windows network services - Win 2000 and XP

Jean-Baptiste Marchand
----[ Introduction ]----

A default Windows system comes with different network services, enabled by
default. Usually, it is wise to disable most of them and even all of them,
if the system does not offer network services to other systems.

In this document, we give a possible methodology to complete this task.
Technical details are described in a separate document entitled
_Windows network services internals_ and available at
http://www.hsc.fr/ressources/articles/win_net_srv/ .

The _Windows network services for Samba folks_ presentation, available at
http://www.hsc.fr/ressources/presentations/sambaxp2003/ , describes some
internals of Windows core network services.

Systems used as examples are Windows 2000 (server version) and Windows XP, as
installed by default (DHCP was disabled and IPv4 address 192.70.106.143 was
assigned to the unique network interface). Of course, the best solution is to
choose only required services at installation, even if it does not exempt you
from all the setup described here.

----[ Services identification ]----

A quick way to identify running network services is to list opened TCP and UDP
ports with the netstat command.

On a Windows 2000 system, the netstat -an command returns:

C:\WINNT>netstat -an

Active Connections

Proto Local Address Foreign Address State
TCP 0.0.0.0:25 0.0.0.0:0 LISTENING
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:443 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1026 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1027 0.0.0.0:0 LISTENING
TCP 0.0.0.0:3372 0.0.0.0:0 LISTENING
TCP 0.0.0.0:4983 0.0.0.0:0 LISTENING
TCP 192.70.106.143:139 0.0.0.0:0 LISTENING
UDP 0.0.0.0:135 *:*
UDP 0.0.0.0:445 *:*
UDP 0.0.0.0:1028 *:*
UDP 0.0.0.0:1029 *:*
UDP 0.0.0.0:3456 *:*
UDP 192.70.106.143:137 *:*
UDP 192.70.106.143:138 *:*
UDP 192.70.106.143:500 *:*

On a Windows XP system, the netstat -ano command returns:

C:\WINDOWS>netstat -ano

Active Connections

Proto Local Address Foreign Address State PID
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 884
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING 976
TCP 0.0.0.0:5000 0.0.0.0:0 LISTENING 1160
TCP 192.70.106.143:139 0.0.0.0:0 LISTENING 4
UDP 0.0.0.0:135 *:* 884
UDP 0.0.0.0:445 *:* 4
UDP 0.0.0.0:500 *:* 704
UDP 0.0.0.0:1026 *:* 1112
UDP 0.0.0.0:1027 *:* 976
UDP 127.0.0.1:123 *:* 976
UDP 127.0.0.1:1900 *:* 1160
UDP 192.70.106.143:123 *:* 976
UDP 192.70.106.143:137 *:* 4
UDP 192.70.106.143:138 *:* 4
UDP 192.70.106.143:1900 *:* 1160

_Warning_:

The netstat command does not exactly report TCP and UDP ports states. Instead,
it reports state of TDI transport addresses and connection endpoints, whereas
only TDI connection endpoints represent TCP or UDP sockets.

In particular, when a Windows system establishes an outgoing TCP connection
(active open), the local port used as source is reported as in the LISTENING
state.

In the following example, the local system has established a TCP connection from
source port 1367 to destination port 22 of a remote system.

The netstat command output, filtered to show only lines containing port number
1367 is:

C:\WINDOWS>netstat -anp tcp | find ":1367"
TCP 0.0.0.0:1367 0.0.0.0:0 LISTENING
TCP 192.70.106.142:1367 192.70.106.76:22 ESTABLISHED

The second line shows the established connection, from local port 1367 to remote
port 22. However, the first line is incorrect because it reports local port 1367
in the LISTENING state, whereas no TCP server is available on this port.

Thus, for each outgoing TCP connection, an additional line will appear in
netstat output, showing a TCP port in LISTENING state. It is important to make
the difference between an opened TCP port and one incorrectly reported by netstat
in the LISTENING state.

Note: this bug has been fixed in Windows Server 2003.

Once opened ports are identified, we present recipes to get them closed, step
by step.

----[ Disabling unused services ]----

To minimize opened ports, the first thing to do is to disable services. In our
examples, we will stop services (using the net stop command). However, to
prevent a service from starting at next system restart, startup mode of service must
either be set to manual or disabled. Some services have to be explicitly
disabled, otherwise they will be manually started by the system.

On Windows 2000, the service manager allows modification of startup type of a
service.

C:\WINDOWS>services.msc

The Startup Type (Automatic, Manual or Disabled) can be set under the General
tab of the Properties of each service.

On Windows XP, the sc command (also available in Windows 2000 Resource
Kit) can change the startup type of a service, with such a command:

C:\WINDOWS>sc config service_name start= disabled

(space between start= and disabled is mandatory).

The following command

C:\WINDOWS>sc config service_name start= manual

configures the startup mode of a service to manual.

--[ Windows 2000 ]--

-[ IIS 5 ]-

On Windows 2000, IIS 5 runs by default and is composed of SMTP, HTTP and IIS
administration services. To close TCP ports 25, 80, 443, UDP port 3456, one
port used by IIS administration website (4983 in our example) and two
ports, higher than 1023 for RPC services, these services must be stopped.

The quickest way to stop these services is to stop the iisadmin service (other
services depend on it):

C:\WINNT>net stop iisadmin
The following services are dependent on the IIS Admin Service service.
Stopping the IIS Admin Service service will also stop these services.

World Wide Web Publishing Service
Simple Mail Transport Protocol (SMTP)

Do you want to continue this operation? (Y/N) [N]: y
The World Wide Web Publishing Service service is stopping.
The World Wide Web Publishing Service service was stopped successfully.

The Simple Mail Transport Protocol (SMTP) service is stopping.
The Simple Mail Transport Protocol (SMTP) service was stopped successfully.

...
The IIS Admin Service service was stopped successfully.

Output of the netstat -an command shows that the number of opened ports has been
reduced:

C:\WINNT>netstat -an

Active Connections

Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1026 0.0.0.0:0 LISTENING
TCP 0.0.0.0:3372 0.0.0.0:0 LISTENING
TCP 192.70.106.143:139 0.0.0.0:0 LISTENING
UDP 0.0.0.0:135 *:*
UDP 0.0.0.0:445 *:*
UDP 0.0.0.0:1029 *:*
UDP 192.70.106.143:137 *:*
UDP 192.70.106.143:138 *:*
UDP 192.70.106.143:500 *:*


Finally, the easiest way to prevent IIS services to start next time is by
removing IIS components, via Add/Remove Programs in configuration panel.

-[ IPsec ]-

UDP port 500, used by IKE protocol (Internet Key Exchange) can be closed by
stopping IPsec services service.

C:\WINNT>net stop policyagent
The IPSEC Services service is stopping.
The IPSEC Services service was stopped successfully.

UDP port 500 then disappears from netstat -an output:

C:\WINNT>netstat -an

Active Connections

Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1026 0.0.0.0:0 LISTENING
TCP 0.0.0.0:3372 0.0.0.0:0 LISTENING
TCP 192.70.106.143:139 0.0.0.0:0 LISTENING
UDP 0.0.0.0:135 *:*
UDP 0.0.0.0:445 *:*
UDP 0.0.0.0:1029 *:*
UDP 192.70.106.143:137 *:*
UDP 192.70.106.143:138 *:*

-[ Distributed Transaction Coordinator ]-

Distributed Transaction Coordinator service is enabled by default on a Windows
2000 server and opens TCP port 3372, and one TCP port higher than 1023 (1025 in
our example).

Stopping this service closes two TCP ports:

C:\WINNT>net stop msdtc
The Distributed Transaction Coordinator service is stopping.
The Distributed Transaction Coordinator service was stopped successfully.

List of opened ports is now:

C:\WINNT>netstat -an

Active Connections

Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1026 0.0.0.0:0 LISTENING
TCP 192.70.106.143:139 0.0.0.0:0 LISTENING
UDP 0.0.0.0:135 *:*
UDP 0.0.0.0:445 *:*
UDP 0.0.0.0:1029 *:*
UDP 192.70.106.143:137 *:*
UDP 192.70.106.143:138 *:*


--[ Windows XP ]--

Services that can easily be disabled are:
IPsec services (PolicyAgent)
SSDP Discovery Service (SSDPSRV)
Windows Time (W32Time)

The following commands stop these services:

C:\WINDOWS>net stop policyagent
The IPSEC Services service is stopping.
The IPSEC Services service was stopped successfully.


C:\>WINDOWS>net stop ssdpsrv
The SSDP Discovery Service service is stopping.
The SSDP Discovery Service service was stopped successfully.


C:\>WINDOWS>net stop w32time
The Windows Time service is stopping.
The Windows Time service was stopped successfully.


netstat -ano command shows that the number of opened ports has been reduced (TCP
ports 5000 and UDP 123, 500 and 1900 have been closed):

C:\WINDOWS>netstat -ano

Active Connections

Proto Local Address Foreign Address State PID
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 884
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING 976
TCP 192.70.106.143:139 0.0.0.0:0 LISTENING 4
UDP 0.0.0.0:135 *:* 884
UDP 0.0.0.0:445 *:* 4
UDP 0.0.0.0:1026 *:* 1112
UDP 0.0.0.0:1027 *:* 976
UDP 192.70.106.143:137 *:* 4
UDP 192.70.106.143:138 *:* 4


---[ NetBIOS over TCP/IP (NetBT) ]---

NetBIOS over TCP/IP is typically used on Windows systems to transport the CIFS
protocol (also known as SMB). CIFS is the protocol behind resources sharing
(typically, file and printer sharing).

NetBIOS over TCP/IP uses UDP ports 137, 138 and TCP port 139. To close
these ports, NetBIOS over TCP/IP must be disabled on each network adapter.

For each network adapter in the Network and Dial-up Connection, select
Properties and choose Properties of Internet Protocol (TCP/IP). Click on
the Advanced button, select the WINS tab and check Disable NetBIOS over TCP/IP.
This will close UDP ports 137 and 138 and TCP port 139 on configured adapter.

The lmhosts service, used for NetBIOS name resolution can also be stopped and
disabled:

C:\WINNT>net stop lmhosts
The TCP/IP NetBIOS Helper service is stopping.
The TCP/IP NetBIOS Helper service was stopped successfully.

On Windows 2000, the list of opened ports becomes:

C:\WINNT>netstat -an

Active Connections

Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1026 0.0.0.0:0 LISTENING
UDP 0.0.0.0:135 *:*
UDP 0.0.0.0:445 *:*
UDP 0.0.0.0:1029 *:*

On Windows XP:

C:\WINDOWS>netstat -ano

Active Connections

Proto Local Address Foreign Address State PID
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 884
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING 976
UDP 0.0.0.0:135 *:* 884
UDP 0.0.0.0:445 *:* 4
UDP 0.0.0.0:1026 *:* 1112
UDP 0.0.0.0:1027 *:* 976

---[ CIFS over TCP ]---

Before Windows 2000, the CIFS protocol was typically transported in NetBIOS over
TCP/IP (NetBT), using TCP port 139. Starting with Windows 2000, CIFS can be
transported directly in TCP/IP, without an intermediary NetBT layer. In that
case, TCP port 445 is used (see http://www.ubiqx.org/cifs/SMB.html#SMB.1.2
for more information).

To disable listening on TCP port 445, two methods are possible:
1. disable the NetBT driver
2. add a value in the registry to disable transport of CIFS in TCP


-[ Disabling the NetBT driver ]-

The first method completely disables SMB on a system, i.e both client-side
(workstation service) and server-side (server service).

You first need to stop the workstation and server services (and all services
that depend on them and may still run):

C:\WINNT>net stop rdr
The Workstation service is stopping.
The Workstation service was stopped successfully.

C:\WINNT>net stop srv
The Server service is stopping.
The Server service was stopped successfully.

Once these services are stopped, the NetBT driver can be stopped:

C:\WINNT>net stop netbt
The NetBios over Tcipip service is stopping.
The NetBios over Tcipip service was stopped successfully.

To disable the NetBT driver, the following registry value must be changed:

Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\
Value: Start
Type: DWORD value (REG_DWORD)
Content: 4

On Windows XP, you can use the following command:

C:\WINDOWS>sc config netbt start= disabled


-[ Disabling the raw SMB transport without disabling NetBT transport ]-

In some cases, you might want to run the NetBT driver without using the raw SMB
transport, which uses TCP port 445.

In that case, you can set the following registry value:

Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
Value: SmbDeviceEnabled
Type: DWORD value (REG_DWORD)
Content: 0 (to disable)

After a reboot, TCP port 445 will no longer be opened by the NetBT driver.

The following ports remain opened on Windows 2000:

C:\WINNT>netstat -an

Active Connections

Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1026 0.0.0.0:0 LISTENING
UDP 0.0.0.0:135 *:*
UDP 0.0.0.0:1029 *:*

Under Windows XP:

C:\WINDOWS>netstat -ano

Active Connections

Proto Local Address Foreign Address State PID
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 884
TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING 976
UDP 0.0.0.0:135 *:* 884
UDP 0.0.0.0:1026 *:* 1112
UDP 0.0.0.0:1027 *:* 976


---[ RPC services ]---

Remaining ports are used by RPC services (Remote Procedure Call). The RPC
portmapper and the COM service control manager (COM SCM) both use port 135.
Ports immediately higher than 1023 are used by RPC services and are reachable
via RPC or DCOM (ORPC). As these ports are dynamically allocated, a port mapping
service is needed, the portmapper, to give the port on which a given RPC service
can be reached.

If you want to identify which RPC services is using which TCP or UDP port on
your own system, you can use the rpcdump tool to obtain the list of registered
RPC services in the portmapper database
(http://razor.bindview.com/tools/desc/rpctools1.0-readme.html ).

-[ Windows 2000 ]-

With rpcdump, we can determine that, on our test system, UDP port 1029 is used
by RPC services started by the Messenger service. After disabling this service
(as explained in the Disabling unused services section) and rebooting the
system, this port will be closed.

Also, UDP port 135 will no longer be opened because:
- the last RPC service reachable via UDP has been disabled
- DCOM is not reachable via UDP by default, thus the COM SCM does not listen
on UDP port 135.

TCP port 1026 is used by RPC services started by the Task Scheduler service
(Schedule). It is thus possible to close this port after disabling this service
and rebooting.

Remote Access Connection Manager (RasMan) must also be disabled.

-[ Windows XP ]-

On our Windows XP system, UDP port 1027 is used by RPC services started by the
Messenger service. As in Windows 2000, this port and UDP port 135 will no longer
be opened after disabling this service and rebooting.

TCP port 1025 is used by RPC services of the Task Scheduler service. Again, as
in Windows 2000, this service must be disabled.

--[ Interfaces restriction on Windows 2000 ]--

_Warning_: the interfaces restriction technique described here currently only
works on Windows 2000 (i.e, not on Windows XP).

Until now, we have disabled services that start RPC services, in order to close
the dynamic ports they use. However, sometimes some services such as the Task
Scheduler are needed.

It is possible to restrict listening network interfaces for some RPC services,
more precisely, for those services that do not explicitly listen on all network
interfaces.

A registry value allows the system to configure the list of network interfaces
on which RPC services will listen. The value contains a list of integers that
correspond to network interfaces indexes.

Before Windows 2000, this value contained network devices names, as described in
the 'Configuring the Windows XP/2000/NT Registry Port Allocations and Selective
Bindings' entry in Microsoft Platform SDK documentation, available somewhere at
http://msdn.microsoft.com/ . Starting with Windows 2000, the systems expects
network interfaces indexes, starting at 1.

The two following keys, Rpc\ and Rpc\Linkage\, do not exist by default in the
registry and must be created under the following key:
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\

The value to add is:
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rpc\Linkage\
Value: Bind
Type: REG_MULTISZ
Content: list of network interfaces indexes

Microsoft released on 4/16/2003 a new version of the rpccfg tool, that can list
network interface indexes and configure interfaces restriction. This tool is
available at http://download.microsoft.com/ (search keyword: rpccfg).

The -q option of rpccfg gives the current settings of interfaces and ports
restrictions:

C:\>WINNT>rpccfg -q
RPCCFG: Listening on all interfaces (default configuration)

RPCCFG: Using default port settings

The -l option of rpccfg gives the mapping between network adapters and
interfaces indexes:

C:\WINNT>rpccfg -l
IF[2]: Ethernet: 3Com EtherLink PCI (Microsoft's Packet Scheduler)
IF[1]: Ethernet: MS TCP Loopback interface

On our system, the first index corresponds to the loopback interface (IPv4
address 127.0.0.1). Thus, to restrict RPC service to the loopback interface, we
use the -a option with 1 as argument:

C:\WINNT>rpccfg -a 1
RPCCFG: Listening on the following interfaces
IF[1]: Ethernet: MS TCP Loopback interface

We can verify with the -q option that the interface restriction is correctly
configured:

C:\WINNT>rpccfg -q
RPCCFG: Listening on the following interfaces
IF[1]: Ethernet: MS TCP Loopback interface

RPCCFG: Using default port settings


-[ The case of the portmapper ]-

By default, the portmapper RPC service binds to all network interfaces.

A registry value, ListenOnInternet, controls whether the portmapper RPC service
binds to all interfaces or not. By default, this value does not exist and has
implicitly a default value of "Y":

Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\
Value: ListenOnInternet
Type: REG_SZ
Content: "Y" or "N"

When set to "N", TCP port 135 will only listen on interfaces specified by the
Bind value described in the previous section.

-[ Limits of the interfaces restriction technique ]-

The interfaces restriction technique has some limitations:
- it only works for RPC services that do not explicitly listen on all interfaces.
- it is a global setting, i.e. restrictions can not be implemented on a per-RPC
service basis.
- it seems to work only for TCP transport of RPC services

Tests have shown that the interfaces restriction technique works on Windows 2000
for the TCP transport of the following services:

RPC service of the Distributed Transaction Coordinator service
RPC service of the Task Scheduler service
RPC service of the inetinfo service

It does not work with the UDP transport of the following services (in fact, it
probably does not work with UDP transport at all):

RPC service of the messenger service
RPC service of the inetinfo service


-[ RPC dynamic ports range restriction ]-

By default, TCP and UDP ports for RPC services are allocated in the dynamic
ports range, which starts at 1025 (port 1024 does not seem to be used on Windows
systems). This explains why most of the RPC services lauched at startup listen
on TCP and UDP ports immediately higher than 1023.

It is possible to configure a specific range for ports allocated to RPC
services. This is typically used to ease ports filtering on IP filtering
devices. It can also be used to make a clear distinction between dynamic ports
(typically used when the system is a TCP or UDP client) and ports allocated to
RPC services.

The -pi and -pe option of rpccfg allows to configure the range of ports
allocated to RPC services. To set the range to 4000-4100:

C:\WINNT>rpccfg -pi 4000-4100
The following ports/port ranges will be used for Intranet ports
4000-4100

Default port allocation is from Intranet ports


We can finally verify that our networks interfaces and ports restrictions are
correct:

C:\WINNT>rpccfg -q
RPCCFG: Listening on the following interfaces
IF[1]: Ethernet: MS TCP Loopback interface

The following ports/port ranges will be used for Intranet ports
4000-4100

Default port allocation is from Intranet ports

--[ DCOM ]--

The only remaining opened port is TCP port 135. It is opened by the Remote
Procedure Call (RpcSs) service and it is not possible to disable it because this
service contains the COM service control manager, used by local processes.

TCP port 135 remains opened because it is used to receive remote activation
requests of COM objects. A global setting exists to disable DCOM and can be set
in the registry:
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole
Value: EnableDCOM
Type: REG_SZ
Content: "Y" (to enable) or "N" (to disable)

This registry value corresponds to the 'Enable Distributed COM on this computer'
setting that appears in the dcomcnfg tool:

C:\WINDOWS>dcomcnfg

This procedure is now documented in the #825750 Microsoft knowledge base
article (http://support.microsoft.com/?id=825750 ).

Disabling DCOM is probably a good idea, as it will at least protect systems from
the recent vulnerabilities affecting DCOM, discovered by the Last Stage of
Delirium Research Group (http://www.lsd-pl.net/special.html ) and by the
Xfocus team (http://www.xfocus.org/advisories/200307/4.html ).

When DCOM is disabled, the COM framework returns the E_ACCESSDENIED error code
(0x80700005) when receiving remote activation requests. Thus, exploitation of
the aforementionned vulnerabilities fail.

Disabling DCOM does not close TCP port 135. To close it, one solution
is to remove IP-based RPC protocols sequences from the list that can be used by
DCOM. In our case, the sequence ncacn_ip_tcp (transport on TCP/IP) can be
removed.

The simplest solution for this is to use the dcomcnfg tool and to remove
'Connection-oriented TCP/IP' in the 'Default Protocols' tab.

Under Windows 2000, dcomcnfg directly shows the DCOM properties of the local
system, in particular, the 'Default Protocols' tab. Under Windows XP, dcomcnfg
launches an MMC console showing three nodes. The 'Default Protocols' tab appears
in the properties of the My Computer node, under the Computer node.

The list shown in the 'Default Protocols' tab is stored in the registry, under
the following value:
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc
Value: DCOM Protocols
Type: REG_MULTI_SZ

Thus, it is also possible to directly edit the registry and remove ncacn_ip_tcp
from the DCOM Protocols value.

After a reboot, all ports should be reported as closed, except one UDP port on
Windows XP, which we study in the next section.


--[ caching DNS service (Windows XP) ]--

Starting with Windows 2000, Windows systems include a caching DNS service
(dnscache), that keeps in memory results of DNS requests.

On Windows 2000, this service sends DNS requests on UDP, using a different UDP
source port for each request. On Windows XP, the same port is always used: it is
allocated at the first DNS request and remains the same, as long as the dnscache
service is running.

On our Windows XP system, the port used by the dnscache service is UDP port
1026. If we stop the dnscache service, this port will be closed.

It is possible to disable the socket caching mechanism used by the Windows XP
dnscache service, adding a registry value under the service key:

Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\
Value: MaxCachedSockets
Type: REG_DWORD
Content: 0

With this setting, the Windows XP dnscache service will behave as under Windows
2000, i.e, different UDP sockets are used for each DNS requests.

--[ RPC services started when using the system ]--

Some RPC services can be started when starting some programs. For instance,
using the Component Services component under Windows XP seems to open two TCP
ports, used by RPC services.

Thus, it is always useful to use IP filtering, in addition to minimization
techniques presented here.

----[ Summary ]----

Minimization of network services can be realized in three steps:
- disabling of unused services
- disabling of NetBIOS over TCP/IP and CIFS over TCP
- minimization of RPC services

Services to disable are:
Windows 2000:
- IIS 5: iisadmin, w3svc, smtpsvc
- Others: messenger, msdtc, policyagent, schedule
Windows XP:
- messenger, policyagent, schedule, ssdpsrv, w32time

Disabling of NetBIOS over TCP/IP is specific to each network interface. To
globally disable CIFS over TCP (port 445), the SmbDeviceEnabled registry value
must be added and set to 0 in the registry.

Minimization of RPC services starts by disabling services that register RPC
services.

The removal of the 'Connection-oriented TCP/IP' protocol sequence in the dcomcnfg
utility allows to close TCP port 135.

If necessary, listening interfaces restriction can be configured for some RPC
services on Windows 2000, using the rpccfg tool.

----[ Conclusion ]----

A default installation of a Windows system has many network services. It is
possible and wise to minimize them, leaving only services that are strictly
necessary.

----[ Greetings ]----

Thanks to Jacqueline J. for proofreading this document and suggesting many
improvements.