Hi, me again.
C: This result is coming from Sygate's Stealth Scan.
E: Do all the scanning sites say them same or do they still report differant results, I want to make sure its not a false positive.
C: I have Linklogger setup to alert me when that port is scanned and during the scan the first alert shows Src Port 53 and Dest Port 113 and 2nd alert shows Src Port 80 and Dest Port 113.
E: What IP's does it log for these events?
C: Today I installed KPF v2.1.4.
E: Nice Choice
C: I was messing around with the rules and actually had it setup where I did get a full Stealth result, but stupid me didn't write the rules down I had set as I continued to mess with the rules.
E: Do you get the alert on the workstation to? You should not and anything you do on the workstation should not affect the router.
C: Currently I am messing with the rules where I block port 113 by itself, block local port 113 and remote port 53 and block local port 113 and remote port 80.
E: Using kerios status screen is port 113 in the listening state on your system? Again if it is it should not be showing up through the NAT router.
C: All suggestions are welcome to help me solve this annoying little issue I have.
E: Sorry its me again but what the hell. Did you ask the guys in the GRC group from above?