NetFort Advertising

How to detect new server ports in use on your network

network servers

What is a server?

In client-server processes that use Transmission Control Protocol/Internet Protocol (TCP/IP) or User Datagram Protocol (UDP), the client initiates communication with a server through one of the many well-known ports. In computer networking, a port is an endpoint of communication in an operating system. While the term is also used for physical devices, in software it is a logical construct that identifies a specific process or a type of network service. For example, HTTP traffic typically uses TCP port 80.

What makes a server is that it is the one that accepts a connection from a client. Typically, this port is left open or running so that clients can connect at any time. It is good security policy to restrict the number of ports which are open on a server. Each open port is a way to gain access to that server. In recent times several Ransomware variants spread around networks by exploiting a vulnerability in SMBv1. Infected clients searched for any host with TCP port 445 active and then tried to communicate using the SMBv1 protocol. The image below shows the handshake that makes up a TCP connection request.

TCP three way handshake associated with server ports

Why worry about new server ports?

As I mentioned previously, opening new ports on a server increases that servers attack surface. Keeping the attack surface as small as possible is a basic security measure. New ports become active if you install new software or if you enable a new service on the server. Enabling something such as RDP (remote desktop protocol) can compromise the entire server and provides a way for data to be transferred off.

For important servers on your network you should have an inventory of what applications or services are running so that changes can be detected. You can do this by constantly polling the server on every port number or monitor network traffic going to and from the server. The polling method can be problematic as you will need to constantly bombard the server with connection requests and you may miss something if the application or service was only active for a short time.

If compliance standards such as GDPR are a concern then server monitoring is not just a nice to have, it becomes mandatory. You must maintain an inventory of who is connecting to what if you store sensitive or personal data.

Detecting new server ports by monitoring network traffic

If you monitor network traffic going to and from your important servers you can build up an inventory of what ports are open without the need to interact with the servers. One way to do this is to use a SPAN or mirror port to get a copy of the network traffic going to and from your servers. You would then need a network traffic analysis tool such as LANGuardian to process this data and extract the relevant metadata from the network packets. The image below shows an example of what would be required. The four servers can be monitored via a single SPAN or mirror port.

network diagram showing how you can monitor network traffic

Detecting new server ports with LANGuardian

Once you have your SPAN or mirror port in place and you have a LANGuardian installed monitoring the network traffic you can start to build up an inventory of new server ports. Type “server ports” into the search field at the top of the LANGuardian web interface and select “Network Events (New Server Ports)“. Pick a date range and then see if any new server ports became active during the selected time period. The image below shows a sample of the report output.

LANGuardian Network Events (New Server Ports) report

The report contains a number of fields

  1. Sensor: LANGuardian can process traffic from multiple network points via remote sensors. The sensor field shows which sensor detected activity on the new server port.
  2. Server address: The network device which is accepting client requests.
  3. Port: Which port the server is listening on. Some ports will be labelled.
  4. When detected: The date and time when communication was first detected.
  5. Server reply: This is section of the servers reply to a client. In some cases it is human readable in others it is just a binary string of random characters.

The video below shows an example of this report in action.