NETSCOUT Onetouch AT G2(1TG2-3000)端口掃描功能詳解
在 Internet上,各主機間通過TCP/TP協議發送和接收數據報,各個數據報根據其目的主機的ip地址來進行互聯網絡中的路由選擇。可見,把數據報順 利的傳送到目的主機是冇有問題的。問題出在哪裡呢?我們知道大多數操作係統都支持多程序(進程)同時運行,那麼目的主機應該把接收到的數據報傳送給眾多同 時運行的進程中的哪一個呢?顯然這個問題有待解決,端口機製便由此被引入進來。
本地操作係統會給那些有需求的進程分配協議端口 (protocal port,即我們常說的端口),每個協議端口由一個正整數標識,如:80,139,445,等等。當目的主機接收到數據報後,將根據報文首部的目的端口 號,把數據發送到相應端口,而與此端口相對應的那個進程將會**數據並等待下一組數據的到來。說到這裡,端口的概念似乎仍然抽象,那麼繼續跟我來,彆走 開。
端口其實就是隊,操作係統為各個進程分配了不同的隊,數據報按照目的端口被推入相應的隊中,等待被進程取用,在極特殊的情況下,這個隊也是有可能溢出的,不過操作係統允許各進程指定和調整自己的隊的大小。
不光接受數據報的進程需要開啟它自己的端口,發送數據報的進程也需要開啟端口,這樣,數據報中將會標識有源端口,以便接受方能順利的回傳數據報到這個端口。
Network ports are the entry points to a server or workstation that is connected to the Internet. A service that listens on a port is able to receive data from a client, process it and send a response back. Malicious clients can sometimes exploit vulnerabilities in the server code so they gain access to sensitive data or execute malicious code on the machine remotely.
The Port Scan feature scans the target device for many commonly used open ports. Results are reported on the device’s button on the WIRED ANALYSIS screen. The device’s button must be expanded to view the port scan results.
To use the Port Scan feature:
- Run AutoTest
- Tap the Wired Analysis icon on the HOME screen
- Tap a device’s button to expand it
- Tap the wired TOOLS button
- Tap the Port Scan button
What ports are scanned?
OneTouch AT G2scans the following ports during the “PortScan” process. OneTouch AT does not scan all ports in order to prevent tripping an IDS/IPS system.
7 | echo | 554 | rtsp | |
9 | discard | 556 | remotefs | |
11 | systat | 585 | imap | |
13 | daytime | 634 | ginad | |
17 | qotd | 636 | ldaps | |
18 | msp | 666 | doom | |
19 | chargen | 749 | kerberos-adm | |
20 | ftp-data | 762 | quotad | |
21 | ftp | 892 | ||
22 | ssh | 901 | snmpnameres | |
23 | telnet | 902 | vmware-console | |
25 | smtp | ………… | 912 | apex-mesh |
37 | time | 993 | imaps | |
38 | rap | 995 | pop3s | |
39 | rlp | 1025 | microsoft-adl | |
43 | nicname | 1080 | socks | |
49 | tacacs | 1155 | nfa | |
53 | domain | 1366 | netware-csp | |
66 | sql-net | 1417 | timbuktu-srv1 | |
67 | bootps | 1433 | ms-sql-s | |
68 | bootpc | 1434 | ms-sql-m | |
70 | gopher | 1498 | sybase-sqlany | |
79 | finger | 1521 | oracle-db | |
80 | http | 1524 | ingreslock | |
88 | kerberos | 1525 | orasrv | |
107 | rtelnet | 1720 | h323hostcall | |
110 | pop3 | 1723 | pptp | |
111 | sunrpc | 1812 | radius | |
113 | ident | 1813 | radius-acct | |
118 | sqlserv | 2000-2002 | cisco-sccp | |
123 | ntp | 2049 | nfs | |
135 | epmap | 3128 | ndl-aas | |
137 | netbios-ns | 3268 | msft-gc | |
138 | netbios-dgm | 3269 | msft-gc-ssl | |
139 | netbios-ssn | 3306 | mysql | |
143 | imap | 3389 | ms-wbt-server | |
156 | sqlsrv | 4400 | ds-srv | |
161 | snmp | 4488 | awacs-ice | |
162 | snmptrap | 4672 | rfa | |
204 | at-echo | 4899 | radmin-port | |
379 | ldap | 5190 | aol | |
389 | ldap | 5432 | postgresql | |
390 | ldap | 6000-6004 | ms-exchange | |
427 | svrloc | 6005 | x11 | |
443 | https | 8001 | http-alt | |
445 | microsoft-ds | 8080 | http-alt | |
465 | urd | 8443 | pcsync-https | |
512 | exec | 12345 | italk | |
513 | login | 50000 | db2-server-old | |
514 | shell | 60000 | db2-server | |
515 | printer | 62078 | iphone-sync | |
519 | utime |