Send in your Unix questions today! |
See additional Unix tips and tricks

If you have ever needed to survey a large group of systems to find out which of them supported some particular service, such as ftp, telnet, ssh or some other particular application, you have probably thought of numerous ways to query the systems for the required information and display it in some usable fashion. Many methods of obtaining information from servers, however, require some sort of login or a remote shell request that either takes more time than you want to spend or requires you to configure some sort of trust on the part of the systems with the information for the system on which it is being collected. In today's column, we will look at a way to find out about services running on systems without setting up any access ahead of time. In fact, you don't need an account, never mind access to the root account to collect information in an expedient way. By using nmap to query particular ports and some perl text processing to streamline your output, you can produce a list of systems on which a particular port (say 21 for ftp or 23 for telnet) is listening for requests.

To understand how this works, you need to know a little about how nmap works. One of the most well-known port scanners, nmap is mostly used to scan systems from the outside (i.e., without logging into the system) to determine what ports are active. By acquiring a list of responsive ports, you will have an idea what services and applications are likely running on that system. Hackers use tools such as nmap as a starting point in determining what kinds of exploits they might be able to use to attack particular systems.



Nmap isn't just for hackers looking for systems to attach, however. It can also be used to help legitimate systems administrators to inventory applications and services on their systems. You might want to know, for example, which systems on a network you manage are hosting web services, Which provide ssh login support or which systems are providing services.



To use nmap to query a particular port on a subnet, you need to know what port you are interested in and you need to know the subnet you want to query. The command below, for example, attempts a connection to port 1521 on the particular server. This port is the most commonly used by Oracle. You can use a command like this to get the answer:

# nmap -p 1521 10.1.2.34

However, you will get a much speedier response if you include some additional options with your nmap request:

# nmap -p 1521 -P0 -sT 10.1.2.34

The P0 (P and zero) option tells nmap to skip host discovery (i.e., not to ping the systems). The sT option says to use a simple connect() system call to detect port status.

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine