netstat on HP procurve?

[Viliusp]

Hello,

I have slight difficulties in finding command to show listening tcp/udp ports on HP procurve products. Any suggestions?

Sth that would display 'nestat' like information Of course I could go with port scan, but it is far too noisy in production environments (might trigger response from IPS/IDS)

Vilius

[paulgear]

Hi Vilius,

To the best of my knowledge, there is no equivalent to netstat -ln on the ProCurve family.  Even in the hidden command set (http://evilrouters.net/2010/04/06/hidden-procurve-commands/) i have been unable to find any reference to such commands.  (Note that the hidden commands are unsupported and on some models you're not even entitled to use them without HP's permission.)

I think port scans are going to be your best bet (and more supported than the hidden commands).  Be sure to schedule appropriate downtime. :-)

You may find Jeremy L. Gaddis' discussion about access controls (http://evilrouters.net/2010/08/06/access-controls-for-hp-procurve-devices/) helpful here, as well as the quick reference on disabling services in my Network Engineer's Rosetta Stone (http://linuxman.wikispaces.com/Rosetta+Stone+-+initial+setup) and hardening guide (http://linuxman.wikispaces.com/HP+ProCurve+hardening+for+Internet).

[paulgear]

I forgot to mention: i think the best technique of those described in the links above is to use the secure management VLAN. This ensures that ssh, SNMP, and ping are not available from anywhere but that VLAN.