detection opening/closing port

qnguyendang · 12-12-2008, 07:38 AM

Hi,

I plan to write a program which detects closing/opening port (tcp/udp port) events. Whenever a port is opened by an application, or a port is released, my program will be able to detect this event and write this to a log file. I think it is not very difficult but I have no idea to start.

Could anybody help me? Is there any support by Linux for this issue?

Thank you very much,

Nguyen.

business_kid · 12-13-2008, 03:28 AM

Let me suggest:

the LDP project has guides for linux programmers, iirc.
http://www.insecure.org has nmap, which overlaps with your project.
The kernel docs have a list of ports, and the purpose they are assigned to.

I think this is all managed by the kernel, so your programming exercise will be trivial. Too trivial to impress.

qnguyendang · 12-13-2008, 05:52 PM

Thanks for your suggestion, business_kid.

But I want to explain a little more. I do not tend to detect remote ports. And I do not also want to scan ports actively. My program aims to listen passively and it will be triggered by any port opening/closing event, then it write this event to log file. That is my idea.

If nmap can help, please tell me more detail. But if I understand correctly, it may be not really relevant.

I am waiting for any other idea.

Thank you.

Nguyen.

business_kid · 12-14-2008, 09:34 AM

Try

nmap 127.0.0.1

Tinker06 · 12-14-2008, 06:25 PM

He hears you, but he's not really listening.

Try netstat -tn

Once you understand what this is showing you, write something to run that frequently and process the output. UDP might be a little harder since that protocol is "connectionless" by definition.

Cheers

qnguyendang · 12-15-2008, 07:28 PM

Hi,

The try both your suggestions. I understand the output. But the key point here is that I do not want to check frequently like that. Instead, an event will trigger my program. I think auditd is quite suitable in this case.

Sorry making you confusing because of my poor explanation.

Thanks,

Nguyen.