Linux check local open ports

To determine if someone is listening, attempt to connect by loopback. If it fails, then the port is closed or we aren't allowed access. Afterwards, close the connection.

Modify this for your use case, such as sending an email, exiting the script on failure, or starting the required service.

@AmanJain cat waits for EOF or Ctrl-C to quit. You'll need to adjust this for your protocol. BTW are you running this to a remote server?

@AmanJain I've updated it for a local system. You do just want to check if it's listening correct? There isn't any protocol checking, such as requesting a page via http?

if a port is taken, it returns nothing, is there any way to make it say "port is taken by " or smth

This is not a reliable method since not all OS (e.g. ubuntu 16 as I discovered today) are shipped with bash compiled for building the /dev/tcp/IP/PORT tree

I use it with 127.0.0.1 as "remote" address.

this returns "0" if the port is open and "1" if the port is closed

-z Specifies that nc should just scan for listening daemons, without sending any data to them. It is an error to use this option in conjunc- tion with the -l option.

That seems to be the easiest way, thanks. The sample script link is not working anymore though, yet it's quite self-explaining anyways.

Nice! This is much faster than the other answers on a server with many ports open. Returns in

The -z flag is not available in the nmap based ncat which most recent distros ship with: Fedora, Centos, etc. (nmap-ncat-6.01-9.fc18.x86_64)

@Sean unix commands typically return '0' to indicate success and non-zero for failure. So '0' indicates that it successfully connected and non-zero that it didn't connect for some reason. Note, however, that some versions of 'nc' don't support the '-z' argument so stackoverflow.com/a/25793128/6773916 is arguably a better solution.

You can use netstat this way for much faster results:

netstat -lnt | awk '$6 == "LISTEN" && $4 ~ /\.445$/' 

netstat -anp tcp | awk '$6 == "LISTEN" && $4 ~ /\.445$/' 

This will output a list of processes listening on the port (445 in this example) or it will output nothing if the port is free.

Actually it is correct syntax but probably you're using Linux and I am on Mac. For Linux use this: netstat -lnt | awk '$6 == "LISTEN" && $4 ~ ".445"'

In order to check for port 80 I needed to use awk '$6 == "LISTEN" && $4 ~ "80$"' . Instead of checking for the dot before the port number with \.80 , I used 80$ . Otherwise, this also matched IP addresses containing .80 and ports starting with 80 such as 8000 .

@PatrickOscity: Good point, but to make this robust to you need to combine both approaches: awk '$6 == "LISTEN" && $4 ~ "\.80$"'

You can use netcat for this.

connects to the server and directly closes the connection again. If netcat is not able to connect, it returns a non-zero exit code. The exit code is stored in the variable $?. As an example,

will return 0 if and only if netcat could successfully connect to the port.

This answer needs more upvotes. nc works perfectly for this case. the /dev/tcp trick is clever, but seems difficult to implement a script with signal interrupts.

nc has the -z flag for this purpose, which doesn't require taking input from /dev/null . There's already an answer using the -z flag above.

@AbeVoelker Not all versions of nc support the -z flag. I am on CentOS 7 and found Tony's solution to be what I needed.

Based on Spencer Rathbun's answer, using bash:

Good, it will suppress "Connection Refused" message. Auto-exits if the service accept the connection without wait forever.

Best solution for services that send no data after a new connection. About 20 times faster than calling netcat. Can be shortened to : &>/dev/null

I'd add a timeout to get a closed result faster: timeout 5s bash -c ': &>/dev/null ' && echo open || echo closed

@user1338062 This happens on an Ubuntu Bionic on Azure against external IP (not localhost or 127.0.0.1 ).

they're listed in /proc/net/tcp.

it's the second column, after the ":", in hex:

> cat /proc/net/tcp sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode 0: 00000000:0016 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 10863 1 ffff88020c785400 99 0 0 10 -1 1: 0100007F:0277 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 7983 1 ffff88020eb7b3c0 99 0 0 10 -1 2: 0500010A:948F 0900010A:2328 01 00000000:00000000 02:00000576 00000000 1000 0 10562454 2 ffff88010040f7c0 22 3 30 5 3 3: 0500010A:E077 5F2F7D4A:0050 01 00000000:00000000 02:00000176 00000000 1000 0 10701021 2 ffff880100474080 41 3 22 10 -1 4: 0500010A:8773 16EC97D1:0050 01 00000000:00000000 02:00000BDC 00000000 1000 0 10700849 2 ffff880104335440 57 3 18 10 -1 5: 0500010A:8772 16EC97D1:0050 01 00000000:00000000 02:00000BF5 00000000 1000 0 10698952 2 ffff88010040e440 46 3 0 10 -1 6: 0500010A:DD2C 0900010A:0016 01 00000000:00000000 02:0006E764 00000000 1000 0 9562907 2 ffff880104334740 22 3 30 5 4 7: 0500010A:AAA4 6A717D4A:0050 08 00000000:00000001 02:00000929 00000000 1000 0 10696677 2 ffff880106cc77c0 45 3 0 10 -1 

so i guess one of those :50 in the third column must be stackoverflow :o)

look in man 5 proc for more details. and picking that apart with sed etc is left as an exercise for the gentle reader.

Источник

How to Check (Scan) for Open Ports in Linux

In this tutorial, we will discuss many methods for determining which ports on your Linux system are available to the outside world.

Introduction

One of the first things to check when troubleshooting network connectivity issues or establishing a firewall is whether ports are truly open on your machine.

In this tutorial, we will discuss many methods for determining which ports on your Linux system are available to the outside world.

What is Open Port?

A program that listens on a network port is known as a listening port. You may retrieve a list of your system's listening ports by using tools like ss , netstat , or lsof to query the network stack. Using a firewall, each listening port can be opened or blocked (filtered).

A network port that admits incoming packets from faraway destinations is known as an open port.

For instance, if your web server listens on ports 80 and 443 and those ports are open on your firewall, anyone (excluding blocked ips) can use his browser to view websites housed on your web server. Both ports 80 and 443 are open in this scenario.

Open ports can be a security issue since attackers can use them to exploit vulnerabilities or carry out other types of attacks. All other ports should be closed and just the ports required for your application's operation should be exposed.

Check Open Ports with nmap

Nmap is a network scanning program capable of scanning both single hosts and big networks. It's mostly used for penetration testing and security assessments.

When it comes to port scanning, nmap should be your first choice if it is available. Nmap can determine the Mac address, OS type, kernel versions, and much more in addition to port scanning.

Which ports are listening for TCP connections from the network can be determined by using the following command from the console:

The -sT option instructs nmap to scan for TCP ports, whereas the -p- option instructs it to scan for all 65535 ports. If the -p- option is not specified, nmap will only scan the 1000 most popular ports.

Output Starting Nmap 7.60 ( https://nmap.org ) at 2019-07-09 23:10 CEST Nmap scan report for 10.10.8.8 Host is up (0.0012s latency). Not shown: 998 closed ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:05:49:23 (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 0.41 seconds 

Only ports 22 , 80 , and 8069 are open on the target system, according to the output.

Instead of -sT , use -sU to scan for UDP ports:

Visit the nmap man page for more information and to learn about all of this tool's other useful features.

Check Open Ports with netcat

Netcat (or nc ) is a command-line utility that uses the TCP or UDP protocols to read and write data across network connections.

Netcat can scan a single port or a range of ports.

To search for open TCP ports on a distant system with IP address 10.10.8.8 in the range 20-80 , for example, execute the command:

The -z option instructs nc to scan only for open ports and not transfer any data, whereas the -v option provides more detailed information.

This is what the output will look like:

Output The -z option instructs nc to scan only for open ports and not transfer any data, whereas the -v option provides more detailed information. This is what the final product will look like: 

If you just want the lines with open ports written on the screen, use the grep command to filter the results.

nc -z -v 10.10.8.8 20-80 2>&1 | grep succeeded 

Output Connection to 10.10.8.8 22 port [tcp/ssh] succeeded! Connection to 10.10.8.8 80 port [tcp/http] succeeded! 

Pass the -u argument to the nc command to scan for UDP ports:

nc -z -v -u 10.10.8.8 20-80 2>&1 | grep succeeded 

Check Open Ports using Bash Pseudo Device

The Bash shell /dev/tcp/.. or /dev/udp/.. pseudo-device can also be used to determine whether a port is open or closed.

Bash will open a TCP or UDP connection to the specified host on the specified port when a command is run on a /dev/$PROTOCOL/$HOST/$IP pseudo-device.

The if..else statement below will check if port 443 on kernel.org is open:

if timeout 5 bash -c '/dev/null' then echo "Port is open" else echo "Port is closed" fi 

What is the purpose of the code above?

Because the default timeout when connecting to a port via a pseudo-device is so long, we're utilizing the timeout command to kill the test command after 5 seconds. The test command will return true if the connection to kernel.org port 443 is established.

Use the for loop to check for a port range:

for PORT in ; do timeout 1 bash -c "/dev/null" && echo "port $PORT is open" done 

You will get an output like below:

Output port 22 is open port 80 is open 

Conclusion

We've taught you how to scan for open ports with a variety of tools. You can also check for open ports using other utilities and methods, such as the Python socket module, curl , telnet , or wget .

If you have any queries, please leave a comment below and we’ll be happy to respond to them.

Источник