2.2.9. Verifying Which Ports Are Listening

Unnecessary open ports should be avoided because it increases the attack surface of your system. If after the system has been in service you find unexpected open ports in listening state, that might be signs of intrusion and it should be investigated.

Issue the following command, as root, from the console to determine which ports are listening for connections from the network:

netstat -tanp | grep LISTEN

~]# netstat -tanp | grep LISTEN
tcp        0      0 0.0.0.0:45876               0.0.0.0:*                   LISTEN      1193/rpc.statd      
tcp        0      0 192.168.122.1:53            0.0.0.0:*                   LISTEN      1241/dnsmasq        
tcp        0      0 127.0.0.1:631               0.0.0.0:*                   LISTEN      1783/cupsd          
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      7696/sendmail       
tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN      1167/rpcbind        
tcp        0      0 127.0.0.1:30003             0.0.0.0:*                   LISTEN      1118/tcsd           
tcp        0      0 :::631                      :::*                        LISTEN      1/init              
tcp        0      0 :::35018                    :::*                        LISTEN      1193/rpc.statd      
tcp        0      0 :::111                      :::*                        LISTEN      1167/rpcbind

Copy to Clipboard

Toggle word wrap

Review the output of the command with the services needed on the system, turn off what is not specifically required or authorized, repeat the check. Proceed then to make external checks using nmap from another system connected via the network to the first system. This can be used verify the rules in iptables. Make a scan for every IP address shown in the netstat output (except for localhost 127.0.0.0 or ::1 range) from an external system. Use the -6 option for scanning an IPv6 address. See man nmap(1) for more information.

The following is an example of the command to be issued from the console of another system to determine which ports are listening for TCP connections from the network:

nmap -sT -O 192.168.122.1

~]# nmap -sT -O 192.168.122.1

Copy to Clipboard

Toggle word wrap

See the netstat(8), nmap(1), and services(5) manual pages for more information.

맨 위로 이동

이 콘텐츠는 선택한 언어로 제공되지 않습니다.

2.2.9. Verifying Which Ports Are Listening

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat 소개

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links