Had to share this online tool - been using it a while now, has been helpful - if you know of any others, won't you please share them



https://www.grc.com/x/ne.dll?bh0bkyd2

•

•

•

•

Please take just a moment to read and consider these three points:https://www.grc.com/transpixel.gif
Your use of the Internet security vulnerability profiling services on this site constitutes your FORMAL PERMISSION for us to conduct these tests and requests our transmission of Internet packets to your computer. ShieldsUP!! benignly probes the target computer at your location. Since these probings must travel from our server to your computer, you should be certain to have administrative right-of-way to conduct probative protocol tests through any and all equipment located between your computer and the Internet.

/dons Kevlar underware to deflect flame...:

Steve Gibson has been around for loooonnngg time, as has his site with the Shields Up! test. I'm not going to place any overall judgement on the guy, but let's just say that he has history of being very opinionated about things, sometimes to the point of being what you could call "adamantly wrong" .

I do have to say that this side of his personality definitely comes into play when he dives into the waters of security-related issues. I've seen him try to make monsters out of what are, in reality, relatively minor security problems/exploits, and I've also seen him defend his positions against overwhelming evidence to the contrary put forth by security experts more respected than he.

Don't get me wrong; his online tests do have more than some merit, but they also have their flaws in terms of their comprehensiveness and accuracy. In addition to that, the analysis you'll get from a Shields Up! scan can be a bit more on the "alarmist" side than is really necessary.

Given that, I'd suggest that you run some of your own Intrusion Detection tests against the computers on your network. Links in this Google search should yield some options in that regard:

http://www.google.com/search?hl=en&q...=Google+Search

Please - no personal attacks - it might dissuade others from contributing

of course, one could do a Google Search (these readers are savy) - but that defeats that purpose of getting Personal Opinions on Personally Tested online tools

Not a personal attack at all.

I would give a very similar critique of, and similar advice regarding, any network security service or software which represented itself to be a more "be all and end all" tool than it really was.

Additionally, I do tend to be a bit more adamant about my assessment when the accompanying text that describes the tool and the dangers that one faces without it are written in such a way that they may (purpously?) instill in the average user a bit more fear of threats than is actually warranted.

That said, my assessment of the usefullness of GRC's offerings stands, as does my statement that doing your own Intrusion/penetration/etc. testing will give you a much better idea of how secure your particular network is a whole.

Are you going to take the word of a guy whos network was breached by a 13y/o? Seriously, "stealthing" under many situations can actually give back _more_ information than just having the port closed, especially on server system. This "stealthing' is just another farce from the Steve Gibson camp. If you have a system that is listening on port 80 and stealthing everything else, the attacker obviously knows that a system exists there, and using timing attacks a sophistocated attack can even determine the type of firewall you are running as stealthing adds more latency than having the port just not being open. This latency may be calculated be using a carefully constructed request to any open services. Once this is accomplished, the attacker can make a good guess about the firewall based on this data.