is it possible to create a label or report that looks for a certain port that is being used? We have a software that connects of a few various ports and we would like to know how may workstations connect on certain ports. For example all workstations with the open port of 8601 going to IP xxx.xxx.xxx.xxx, but the ip address part is not as important as just knowing the workstations using specific ports. I have tried creating a label looking for open port # but it does not return any results.

Thank you
Answer Summary:
Cancel
1 Comment   [ + ] Show Comment

Comments

  • I would think you would have to run a command to list open ports, and then export that data to a text file that KACE will read into a custom inventory. Then you could run a search for a specific port and have it sorted out into a label.
    It'll take some work to get it there.
Please log in to comment

Answers

2
That is easy if you use a CIR to look for that info.

The target (foreign address) is the key to solving your problem.  Since the source port can vary but the foreign address and port remains constant you create a CIR to look for connections to that ip:port or DNSname:port. 

In this example I want to find all machines that attach to my kbox port 52230 and see what ports the source machines are using.

First do a netstat -a on a machine you know is attached to the server you want to look for a connection too

S5J4i3.jpeg
I see the machine is talking to the KBox on port 52230

Create a CIR to run net stat and filter for that server only. 

UGfBpS.jpeg

Create a wizard report on the cir and filter for is not null and contains the source port of your desire.

lJhl4s.jpeg

PTMFOQ.jpeg

M0G4NO.jpeg

kcisAs.jpeg
RVWtz1.jpeg
Answered 04/03/2015 by: SMal.tmcc
Red Belt

Please log in to comment
Answer this question or Comment on this question for clarity