Monitoring closed ports?

mperkel · 01-16-2007, 07:05 AM

OK - yes this sounds strange but what I'd like to do is to be able to monitor the IP addresses that attempt to access a specific closed port on a server. Can that be done? The port has to remain closed.

osdeals · 01-16-2007, 09:14 AM

You might want to use portsentry in Advanced or Stealth mode. Been using it for ages now on a large number of linux boxes without any problems.

nx5000 · 01-16-2007, 12:43 PM

Quote:

The port has to remain closed

Isn't portsentry opening the ports? Or does stealth mode means ports remain closed (Last time I used porsentry it was opening everything)

I guess you will need a low-level mechanism, like netfilter ipqueue or something with libpcap.

osdeals · 01-16-2007, 09:03 PM

No, portsentry in advanced or stealth mode doesn't really open the ports.

netstat -pan on a machine running portsentry in advanced mode shows only the following related to portsentry.

Code:

raw   0   0 0.0.0.0:6    0.0.0.0:*     7           8998/portsentry
raw   0   0 0.0.0.0:17   0.0.0.0:*     7           9006/portsentry

you need to edit the /etc/portsentry/portsentry.modes file to ensure you're using either stcp & sudp or atcp & audp. Running portsentry in vanilla tcp & udp mode will open up the ports.