Alle Schaltjahre einmal kommt es vor, dass ich eine neue Blackbox in eines meiner Netzwerke hänge und wissen will, was die Hersteller alles für Netzwerk-Services auf dem Gerät betreiben und gegen das LAN freigeschaltet haben.
Solche Services kann man notabene auch gut verwenden, um eine bessere Überwachung mit monit einzurichten (statt einem simplen Ping prüft man beispielsweise, ob der HTTP-Server auch tatsächlich auf HTTP-Requests antwortet).
Am Besten verwendet man dazu nmap, mit folgendem Befehl, um zumal die privilegierte Port-Range abzugrasen:
# nmap -v -sV -O -sS -T5 10.1.2.3
Starting Nmap 7.40 ( https://nmap.org ) at 2019-03-10 12:07 CET
NSE: Loaded 40 scripts for scanning.
Initiating ARP Ping Scan at 12:07
Scanning 10.1.2.3 [1 port]
Completed ARP Ping Scan at 12:07, 0.22s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 12:07
Completed Parallel DNS resolution of 1 host. at 12:07, 0.02s elapsed
Initiating SYN Stealth Scan at 12:07
Scanning 10.1.2.3 [1000 ports]
Discovered open port 53/tcp on 10.1.2.3
Discovered open port 111/tcp on 10.1.2.3
Discovered open port 22/tcp on 10.1.2.3
Discovered open port 80/tcp on 10.1.2.3
Completed SYN Stealth Scan at 12:07, 2.48s elapsed (1000 total ports)
Initiating Service scan at 12:07
Scanning 4 services on 10.1.2.3
Completed Service scan at 12:07, 14.22s elapsed (4 services on 1 host)
Initiating OS detection (try #1) against 10.1.2.3
NSE: Script scanning 10.1.2.3.
Initiating NSE at 12:07
Completed NSE at 12:07, 2.09s elapsed
Initiating NSE at 12:07
Completed NSE at 12:07, 0.01s elapsed
Nmap scan report for 10.1.2.3
Host is up (0.0043s latency).
Not shown: 996 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.7p1 Debian 5+deb8u3 (protocol 2.0)
53/tcp open domain
80/tcp open ssl/http 0.4
111/tcp open rpcbind 2-4 (RPC #100000)
MAC Address: 00:00:00:00:00:00 (PC Engines GmbH)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.6
Uptime guess: 3.768 days (since Wed Mar 6 17:41:57 2019)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=255 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 22.34 seconds
Raw packets sent: 1149 (53.132KB) | Rcvd: 1141 (48.056KB)
Quelle: Nmap Cheat Sheet
Wer Zeit und Geduld hat, lässt gleich alle 65’000+ Ports scannen:
# nmap -v -p 1-65535 -sV -O -sS -T5 10.1.2.3
