Dean Wilson@UnixDaemon: ... It's not even close to relevant.

Wed, 08 Mar 2006

Know Thy Open Network ports
Which ports do your servers have open right now? How did you check? Netstat? Are you really sure that it's doing the right thing? What the host claims to be exporting isn't always the same as what other hosts on the network see. When did your DNS server start exposing that TCP port? Has it always been there?

I want a tool that keeps track of what ports a machine has open and shows me changes (and tracks when things change). It has to scan the whole port range from top to bottom and it needs to do UDP scans in under a couple of hours. Think of tripwire but for network ports. Changes have to be approved or they keep being flagged as suspicious. As a side effect it'll also show you when things go away. Hard to write? Not really. But why don't most of us already have it built and running?

It's also worth pointing out that this isn't the same role that programs like Nagios fill. You tell Nagios what to watch and it picks up changes in that limited scope. I want something to watch the whole (finite) port range and show me things I didn't think about.

Like this post? - Digg Me! | Add to del.icio.us! | reddit this!

Posted: 2006/03/08 20:45 | /security | Permanent link to this entry | This entry + same date

October 2008	5
September 2008	4
August 2008	12
July 2008	9
April 2008	4
March 2008	1
February 2008	1
January 2008	15
August 2007	2
June 2007	9
May 2007	6
April 2007	8
March 2007	31
February 2007	3
January 2007	21
December 2006	1
November 2006	4
October 2006	6
September 2006	32
August 2006	17
July 2006	14
June 2006	9
May 2006	13
March 2006	11
February 2006	16
January 2006	11
December 2005	1
November 2005	6
October 2005	19
September 2005	25
August 2005	16
July 2005	16
June 2005	13
May 2005	2
April 2005	19
March 2005	31
February 2005	20
January 2005	31
December 2004	21
November 2004	30
October 2004	32
September 2004	18
August 2004	7
July 2004	14
June 2004	5