Re: [gentoo-user] I've been hacked.

[Adam <adam@jaftan.com.au>]

>>> looks like, your ISP has a Transparent Proxy Setup running.
> 
> Should I be worried about that?

No.

>> Ports being shown as open does not mean that your machine is
>> listening, more like the firewall has some holes in it.  If the
> 
> Really?  I thought a service had to be listening for the port to be
> open.  So from nmap, there is no way to tell the difference between a
> port that isn't blocked by a firewall and one that is listening?

You're right - a TCP service does need to be listening for the port to
be shown as open. However, a device in the path like a proxy may answer
on behalf of the actual destination. ISPs can do this so that you will
use their proxy without having to configure a proxy in your browser.

Firewalls can block ports in two ways;
1.Reject the packet, that is, respond to the SYN with an RST packet
(which is also what the operating system does if the port is closed) and
not forward the packet to the destination
2. Drop the packet, that is, dont respond to the packet or forward it on
to the destination.