- [Instructor] In the previous video,
we looked at what is port forwarding
and mounting remote drives.
This video is named network traffic and port analysis.
This video discusses various utilities for port analysis.
We'll see how to use the lsof command
and then the netstat command for port analysis.
Network ports are essential parameters
of network-based applications.
Applications open ports on the host
and communicate to a remote host through them.
Having awareness of opened and closed ports
is essential for, say, security context.
Malware and rootkits may be running on the system
with custom ports and custom services
that our attackers do capture unauthorized access
to data and resources.
By getting the list of opened ports
and services running on the ports,
we can analyze and defend the system
from being controlled by rootkits
and helps remove them efficiently.
The list of opened ports is not only helpful
for malware detection, but it's also useful
for collecting information about opened ports in the system.
This enables us to debug network-based applications.
It helps to analyze whether certain port connections
and port listening functionalities are working fine.
Various commands are available for listing ports
and services running on each port.
For example, lsof and netstat.
These commands are, by default,
available on all GNU Linux distributions.
How to do it.
In order to list all open ports on the system
along with the details of each service attached to it,
use lsof minus-I.
Each entry in the output of lsof corresponds to
each service that opens a port for communication.
The last column of output consists of lines
similar to something like this.
In this output, 192.168.6.234
corresponds to the local host,
and voodoo corresponds to the remote host.
50642 is the port opened from the current machine
and netbios-ssn is the port to which
the service connects at the remote host.
In order to list the open ports
from the current machine, use this command.
Nice, now let's see how it works.
This regex for grep is used to extract
the host port portion, codon 34395 dash greater than
from the lsof prompt.
The next grep is used to extract the port number,
which is numeric.
Multiple connections may occur through the same port,
and hence, multiple entries of the same port may occur.
In order to display each port once,
they are sorted and the unique ones are printed.
Let's go through additional utilities
that can be used for viewing the open port
and network traffic-related information.
We can see open port and services using netstat.
Netstat is another command for the network service analysis.
Explaining all the features of netstat
is not in the scope of this video.
We're not going to learn how to list services and port numbers.
Use netstat minus-tnp to list
opened port and services like so.
Well, that's just about it for this video.
We've learned what network traffic
and how to perform port analysis.
In the next video, we'll be creating arbitrary sockets.