ping port

[jerry1]

What port does ping use??

[Jeff_Traigle · Accepted solution]

Ping doesnt' use any ports. It uses ICMP at the internet layer of the network stack. Ports are used at the next higher level, the transport layer.

[Torsten.]

Hi,

ping is using the ICMP (Internet Control Message Protocol) - it is not port based.

[jerry1]

I have a vendor saying that our temp
monitoring box is reciving pings(from
monitoring) to port 3001 on the box, which
is the firmware upgrade port, and that the
pings are causing the box to hang from
time to time.

[Jeff_Traigle]

Your first step is finding out what system the traffic is coming from so you can isolate what's running to cause it. You can use tcpdump or something similar to gather this info. My guess would be that it's some kind of network security scan occurring... possibly some kind of system monitoring tool that's configured to test that port at that IP address for some reason. Definitely not a ping in the technical sense though.

[jerry1]

Actually, there is a box that does port
scans to get inventory information from nodes.
But why it is only affecting the one temp
monitoring box I do not know. Vender says
to turn of check box for "allow firmware
upgrades" which would disable port 3001.

[Tor-Arne Nostdal]

The vendor tell you how to avoid that your computer run into a hang when it receive the "ping"

You just need to make sure that you remember this in case you want to upgrade firmware via network on this portnumber later...

You could also take the opposite approach.
Stop the source of this "ping"

Some eager persons running security checks like to run portscans and cracker tools.
Such activity should be done with great care as they can be the biggest threat for security themselves.

Securing your systems 100% towards such tools is difficult when they are used within your private network (inside firewalls).

I would kindly ask the persons that scan my servers to avoid specific ports or port ranges.
If I state that port xxxxx is used for Firmware Upgrades on host YYYYY... Then why bother to scan it ?

Most such monitoring software can be configured to avoid hosts/ports.

/Tor-Arne