How to find out the Firewall has open ports.

[Amruth]

All,

I have a server in our diaster recovery site and need to install a security related software on that. The Management station for the security software is on other side of a firewall.

how can i confirm from my disaster recovery server that firewall ports are open so that the managment station can talk the client continuously to get the alerts.

lets assume the ports are 1001 and 1300

Any suggestion is accepted.

Tx,
AM

[Biswajit Tripathy]

Try to do a telnet to the above ports from outside
firewall to see if it's blocked:

$ telnet management_station_IP_address 1001/tcp

The above command will timeout if the port is blocked
(or return immediately with "connection denied" if
firewall is configured to send back a RST). If the
port is open, you would get a message
like "Connected to "

- Biswajit

[Ionut Grigorescu_2]

Hi,

you can use nmap, is a very good port scaner:
http://www.insecure.org/nmap/nmap_download.html

have fun...

[Bill Hassell]

This is not simple to answer. While a network administrator would say the port is open or closed, behind this answwer are options such as one-way versus two-way, port open only to specific IP addresses either inside or outside or both, port closed to IP addresses without a valid DNS value, ports open to specific MAC addresses, etc. telnet can connect on any port (telnet remote_host 1001 but it will likely not return anything useful except that the port was closed. It cannot tell you if it was closed by the remote host or the firewall.

You need to talk to your firewall administrator. Since this is managing security software, the port must be locked down very tight to prevent intrusion--you don't want it fully opened.

[Steven E. Protter]

You should check with management before you start running port scans.

There are a number of good websites that will probe your firewall for you, however some organizations require permission prior to doing such things.

Some of these sites can dirupt your organizations's Internet access.

SEP

[Jeff Schussele]

Hi,

I have to agree with Bill.
There are far too may reasons why a request to the port could be denied.
The best way to determine port status is to ask the admin of that FW exactly what the status is.

My 2 cents,
Jeff

[Ralph Grothe]

True, taking also into account that a firewall can as well just open up certain ports on receiving a specific pattern via port knocking makes it even more difficult.
Although most times you don't need this sophistication.
First talk to your firewalls' admins, and ask them if the port you require is open.
They have logs to look at and trace your passing attempts.
Generally nmap is quite a good tool.
It even provides various "stealth" scanning strategies to trick some firewalls and can do operating system detection (most of the times)
Because occasionally communication to our or unknown firewall admins is somewhat impaired, or because we lack time for,
nmap has proven very valuable to us.

[Emanuele De Angelis]

Try nessus.
Nessus is a security scanner.
Bye

[Amruth]

Thanks to all.

The security here is very tight.

I am in touch with the Network floks to help me.

regards,
AM