『葛帅的主页』

Verifying Which Ports Are Listening

Linux CentOS7 Port_Listening

There are two basic approaches for listing the ports that are listening on the network. The less reliable approach is to query the network stack commands such as netstat -an or lsof -i. This method is less reliable since these programs do not connect to the machine from the network, but rather check to see what is running on the system. For this reason, these applications are targets for replacement by acctackers. Crackers attempt to cover their tracks if they open unauthorized network ports by replacing netstat and lsof with their own, modified versions.
A more reliable way to check which ports are listening on the network is to use a port scanner such as nmap.
The following command issued from the console determines which ports are listening for TCP connections from the network:

nmap -sT -O localhost

The output of this command appears as follows:

This output shows the system is running portmap due to the sunrpc service. However, there is also a service that I don't know on port 8009. To check if the port is associated with official list of known services, type:

cat /etc/services | grep 8009

This command returns no output. It is not associated with a known service.
Next, check for information about the port using netstat or lsof. To check for port 8009 using netstat, use the following command:

netstat -anp | grep 8009

The command returns the following output:

Also, the [p] option reveals the process ID(PID) of the service that opened the port. In this case, the open port belongs to java.
The lsof command reveals similar information to netstat since it is also capable of linking open ports to services:

lsof -i | grep 8009

The relevant portion of the output this command follows:

These tools reveal a great deal about the status of the services running on a machine. These tools are flexible and can provide a wealth of information about network services and configuration. Refer to the man pages for lsof,netstat,nmap, and services for more information.

CentOS/RHEL: Install nmap Network Security Scanner

Installation

To install nmap on RHEL based Linux distributions, type the folowing yum command:

#yum install nmap

How do I use nmap command?

To find out nmap version, run:

#nmap --verison

To scan an IP address or a host name(FQDN), run:

#nmap localhost
#nmap 192.168.1.1

Getting more information out of the remote system

The -v option forces verbose output and the -A option enables OS detection and Version detection, Script scanning and traceroute in single command:

#nmap -v -A 192.168.1.1

To scan a range of IP addresses

#nmap 192.168.1.1-50

To scan an entire subnet

#nmap 192.168.1.0/24

Ping only scan

#nmap -sP 192.168.1.1

TCP SYN scan

#nmap -sS 192.168.1.1

UDP scan

#nmap -sU 192.168.1.1

IP protocol scan

#nmap -sO 192.168.1.1

scan port 80,25,443,and 110

#nmap -p 80,25,443,110 192.168.1.1

Scan port ranges 1024-2048

#nmap -p 1024-2048 192.168.1.1

Operating system detection

#nmap -O --osscan-guess 192.168.1.1

相关链接：
Verifying Which Ports Are Listening
CentOS / RHEL: Install nmap Network Security Scanner