Testing firewall port on hpux servers

[Shivkumar]

Dear Sirs,

I want to check whether a firewall port has been opened or not.

I just want to use the command "telnet IP port" to test it.

Please suggest me ways to find out.

Thanks,
Shiv

[Denver Osborn · Accepted solution]

Is there a listner on the remote host's port that you'll be testing?

If you don't have the app or service up and running on the port you're testing, you could startup another instance of sshd on the port to test. or create a shell script and put entries in /etc/inetd.conf and /etc/services... although easy method would be to run sshd.

/opt/ssh/sbin/sshd -p port#

then "telnet ip port" to the box where you started the listener, or even ssh if it's sshd.

Hope this helps,
-denver

[Muthukumar_5]

Ways:

1. netstat -na | grep portno
2. lsof -i:portnumber

You have to install lsof tool to use that.

hth.

[Muthukumar_5]

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=973336

Refer that thread also.

hth.

[saju_2]

Hi shiv

If u have a linux machine, you can use "nmap" for scanning the open ports in a machine.

nmap

Regards
CS

[Yogeeraj_1]

hi shiv,

have a look at the "Firewall verification" slides in the presentation available at: http://www.dsluug.org/handouts/pdf/firewall-presentation.pdf

hope this helps too!

kind regards
yogeeraj

[Raj D.]

Hi Shiv ,

Download the lsof utility from :

http://hpux.cs.utah.edu
http://gatekeep.cs.utah.edu

And run , to see the details of that port:
# cd /usr/local/bin/
# lsof -i:

Also check with netstat
# netstat -n | grep EST | grep port_no


Enjoy,
hth,

Raj.

[Steven E. Protter]

Actually telnet portnumber is a pretty good way of figureing this out.

The correct response of a firewall is connection refused.

I just started using nnmap on Linux and it would be interesting to see the results run against an HP-9000 server running a firewall.

Also recommend following on the 9000 box.


tail -f /var/adm/syslog/syslog.log

During the test. You should see some activity there during certain tests, especially if the port is open.

SEP

[Shivkumar]

Hi Steven; Could you please let me know what output should we observe if port is already opened ?

Appreciate if you can paste a sample output here.

Thanks,
Shiv

[Steven E. Protter]

Here is example from a connection to an open port, port 22

Nov 15 13:12:49 hpweb inetd[4757]: registrar/tcp: Connection from hpweb (192.168
.0.70) at Tue Nov 15 13:12:49 2005


SEP

[Muthukumar_5]

You can use netstat to check port is using as,

# netstat -na | grep

Example:

# netstat -na | grep 23
tcp 0 0 *.23 *.* LISTEN
tcp 0 2 xx.xx.xx.xx xx.xx.xx.xx.1361 ESTABLISHED
tcp 0 0 xx.xx.xx.xx xx.xx.xx.xx.57750 ESTABLISHED

LISTEN is saying that port is opened for servicing. ESTABLISHED is giving the connection opened using that port.

hth.

[Shivkumar]

I got the below response for checking the firewall port:-

$ telnet jasmine12.bigguy.com 44409
Trying...
Connected to jasmine12.bigguy.com.
Escape character is '^]'.
Connection closed by foreign host.
$

What does it mena "whether firewall port is open or closed" ?

[Biswajit Tripathy]

That obviously means that the firewall did not
block your connection, i.e port is open as far
as the firewall is connection.

- Biswajit

[Biswajit Tripathy]

Steven E Protter wrote:
>
> Actually telnet portnumber is a pretty
> good way of figuring this out.

I fully agree. Simple technique and does the
job.

>
> The correct response of a firewall is
> connection refused.
>

While that is generally true, there are a large
number of firewalls configured not to reply
(with a RST) for refused connection. In those
cases, client will not receive any "connection
refused" reply and give up after few retries.

- Biswajit