topic ping port in Operating System - HP-UX

ping port

jerry1 — Wed, 13 Dec 2006 11:13:12 GMT

What port does ping use??

Re: ping port

Jeff_Traigle — Wed, 13 Dec 2006 11:43:52 GMT

Ping doesnt' use any ports. It uses ICMP at the internet layer of the network stack. Ports are used at the next higher level, the transport layer.

Re: ping port

Torsten. — Wed, 13 Dec 2006 11:47:37 GMT

Hi,

ping is using the ICMP (Internet Control Message Protocol) - it is not port based.

Re: ping port

jerry1 — Wed, 13 Dec 2006 12:02:39 GMT

I have a vendor saying that our temp
monitoring box is reciving pings(from
monitoring) to port 3001 on the box, which
is the firmware upgrade port, and that the
pings are causing the box to hang from
time to time.

Re: ping port

Jeff_Traigle — Wed, 13 Dec 2006 12:31:45 GMT

Your first step is finding out what system the traffic is coming from so you can isolate what's running to cause it. You can use tcpdump or something similar to gather this info. My guess would be that it's some kind of network security scan occurring... possibly some kind of system monitoring tool that's configured to test that port at that IP address for some reason. Definitely not a ping in the technical sense though.

Re: ping port

jerry1 — Wed, 13 Dec 2006 13:17:19 GMT

Actually, there is a box that does port
scans to get inventory information from nodes.
But why it is only affecting the one temp
monitoring box I do not know. Vender says
to turn of check box for "allow firmware
upgrades" which would disable port 3001.

Re: ping port

Tor-Arne Nostdal — Thu, 14 Dec 2006 20:14:19 GMT

The vendor tell you how to avoid that your computer run into a hang when it receive the "ping"

You just need to make sure that you remember this in case you want to upgrade firmware via network on this portnumber later...

You could also take the opposite approach.
Stop the source of this "ping"

Some eager persons running security checks like to run portscans and cracker tools.
Such activity should be done with great care as they can be the biggest threat for security themselves.

Securing your systems 100% towards such tools is difficult when they are used within your private network (inside firewalls).

I would kindly ask the persons that scan my servers to avoid specific ports or port ranges.
If I state that port xxxxx is used for Firmware Upgrades on host YYYYY... Then why bother to scan it ?

Most such monitoring software can be configured to avoid hosts/ports.

/Tor-Arne