lotus

previous page: 57  What are LISTENING ports? (Firewalls - TCP and UDP Ports)
  
page up: Firewalls FAQ
  
next page: 59  What ports are safe to pass through a firewall? (Firewalls - TCP and UDP Ports)

58 How do I determine what service the port is for? (Firewalls - TCP and UDP Ports)




Description

This article is from the Firewalls FAQ, by Matt Curtin cmcurtin@interhack.net and Marcus J. Ranum mjr@nfr.com with numerous contributions by others.

58 How do I determine what service the port is for? (Firewalls - TCP and UDP Ports)



Since it is impossible to learn what port does what by looking in a list,
how do i do it?

The old hands-on way of doing it is by shutting down nearly every
service/daemon running on your machine, doing netstat -a and taking note of
what ports are open. There shouldn't be very many listening ones. Then you
start turning all the services on, one by one, and take note of what new
ports show up in your netstat output.

Another way, that needs more guess work, is simply telnetting to the ports
and see what comes out. If nothing comes out, try typing some gibberish and
slamming Enter a few times, and see if something turns up. If you get binary
garble, or nothing at all, this obviously won't help you. :-)

However, this will only tell you what listening ports are used. It won't
tell you about dynamically opened ports that may be opened later on by these
applications.

There are a few applications that might help you track down the ports used.

On Unix systems, there's a nice utility called lsof that comes preinstalled
on many systems. It will show you all open port numbers and the names of the
applications that are using them. This means that it might show you a lot of
locally opened files aswell as TCP/IP sockets. Read the help text. :-)

On windows systems, nothing comes preinstalled to assist you in this task.
(What's new?) There's a utility called ``Inzider'' which installs itself
inside the windows sockets layer and dynamically remembers which process
opens which port. The drawback of this approach is that it can't tell you
what ports were opened before inzider started, but it's the best that you'll
get on windows (to my knowledge). http://ntsecurity.nu/toolbox/inzider/.

 

Continue to:













TOP
previous page: 57  What are LISTENING ports? (Firewalls - TCP and UDP Ports)
  
page up: Firewalls FAQ
  
next page: 59  What ports are safe to pass through a firewall? (Firewalls - TCP and UDP Ports)