Snort Forums Archive

Archive Home » Snort Advanced » [HOWTO?] detecting services running on non-standard ports

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

[HOWTO?] detecting services running on non-standard ports

Posted by TheHammer on August 18, 2005 09:04:26

Hi all, this is my trouble:
I have an apaci, an smtp server and a citrix server running on unknown ports and via snort I wanna to
know which port are utilized by my servers)
Any suggestion?

TNX
M.

Posted by roesch on August 18, 2005 20:09:48

You need a passive protocol detector like RNA (from Sourcefire) or maybe an active scanner like nmap
using its protocol discovery capability.

Posted by TheHammer on August 19, 2005 00:17:38

Ok, if I don't need real-time performances (I can obtain off-line dump from the router) can I use snort to
discover the protocols running on non-standard ports? (Vern Paxson's BRO can do it)

TnX
M.

Posted by uva_snort on August 30, 2005 03:13:39

At this moment snort can not by default detect services running as a threat. Not behind wanted ports nor behind unwanted ports.
However snort can be configured to do so. There is an example of detecting ssh traffic to non-standard port 22 in the bleeding rules.
If we want to detect other services as well, similar rules must be created for every service you want to detect.

Combined with the problem snort can not recognize portknocking as a standalone event imho this is a major disadvantage of snort.

Posted by Joel_Esler on August 30, 2005 08:03:37

If you are looking for that sort of detection, like Roesch said, as passive detection method like RNA is
definately what you are looking for.

Joel Esler
SOURCEfire

Posted by uva_snort on August 31, 2005 01:17:36

Is detection of events where unwanted services are used going to be implemented in snort? It is very hard to understand why this is not already part of snort.