If you have nmap installed you can create a cron job in (for example) /etc/cron.hourly called stopped-daemons.sh that contains the following (change the port numbers to those you want to monitor):
Code:
#!/bin/sh
for CLOSED in "$(/usr/local/bin/nmap -p 22,80,443 localhost | /usr/bin/grep 'closed' | /usr/bin/awk {'print $1'})"; do
if [ ! -z "$CLOSED" ]; then
echo "Port $CLOSED has closed."
fi
done
cron should email any output to you and there should only be output if one the ports 22, 80 or 443 becomes closed.