Let's talk about ports, connections, and network services a little bit.
It helps if you know what the network socket is.
That's a connection endpoint, and it consists of an IP address that is followed by a port.
You've probably seen it.
It looks like 0.0.0.0 colon 22, meaning that port 22 is exposed on all local IP addresses.
SS is more than just a network connection.
It also exists as a Unix socket, which is an endpoint in communication with services
on Linux as well as Unix.
SS has become the standard tool to show socket information.
Don't use netstat anymore because it's no longer maintained.
If you just type SS, you see all active connections, but that might not be what you want to see.
You can also use SS-TU, which will show connected TCP and UDP sockets.
SS-TUA, the A is magical.
It adds socket information about sockets that are in listening state.
You can use the N if you don't want to do host name resolution.
Now we have SS-TULPN, which shows TCP as well as UDP sockets in listening state and adds
process name or PID to the output.
And that really helps you to analyze what is going on and whether or not your services
are offering what they need to be offering.
There's another utility that is interesting as well.
That's the NMAP utility.
SS is for analyzing local services.
NMAP can be used to analyze ports that are open on remote hosts.
Use NMAP 192.168.29.100, for instance, to perform a basic scan on one specific host.
Also convenient is NMAP-SN, followed by a network address and a subnet mask, which will
scan a network for all the available hosts.
And NMAP-SV scans for services and will list current versions that are found.
That allows you to remotely check if some services on different hosts might need an
update.
Let me show you these commands.
So if I just use SS, then this is what we can see.
But this is all the Unix sockets as well.
And Unix socket is not network-related.
You might not be interested in that.
I like a command like SS-TUA, T for TCP, U for UDP, and A for showing sockets that
are in a listening state.
You can see that the ports are resolved to the names of the ports.
And if you don't want that name resolving, add an N for no name resolving.
This is probably the most useful stuff because this is showing that on local host IP address,
we have port 631, which is a print server.
And we have port 82 on all IP addresses, IPv6 by default.
And on all IPv4, we have 2022.
Well, you get the idea.
Let me also show you NMAP.
A nice start is NMAP-SN19216829.0.
That's my local network.
And, oh, I need to install it.
Well, let's install it.
While it is installing, let me tell you that NMAP should only be used on your own networks.
If you use it against a network of somebody else, it might be detected as a hacking attempt.
So don't do that.
So here we can see the output of the NMAP command.
It has found a couple of hosts.
And for all of these hosts, we see the IP address.
And we even see if it has been detected what is going on on these hosts.
So based on the MAC addresses in use, NMAP has detected that all of this is VMware.
Now look at that.
It has even detected a hostname, so the Git server hostname.
So let's analyze what this Git server hostname is doing by doing an NMAP on 19216829145.
And there we can see, well, that is kind of disappointing.
All 1,000 scanned ports on Git server are in ignored states.
So that means that apparently this server needs some more work.
But you get the idea.
Do this against any host.
And if any ports are in a listening state, you should see the ports that are in a listening state in the result.
Like here, for instance, where you can see that port 22 is open.
That's a secure shell.
And port 9090 is also open, the Zeus admin, which happens to be the cockpit service.
So that's all that is listening on these hosts.
NMAP is a very nice utility.
And if you don't abuse it for the wrong reasons, then it's a good utility that helps you to analyze what's going on in your network.