Resolution | Follow these steps to test ports between RSA NetWitness appliances.
- Download nwportscan-20190819-1.py attached to this article.
- Copy the nwportscan-20190819-1.py to each NetWitness appliance to be tested using scp, WinSCP or a similar file transfer tool.
- Navigate to the folder where you have copied the script, for example:
cd /root
- Change the script to executable with the following command:
chmod +x nwportscan-20190819-1.py
- Execute the script:
./nwportscan-20190819-1.py
- When prompted, enter the host name or IP address of the target host to be scanned.
- Wait for the script to complete. This will take between two seconds and nine minutes in most cases.
- Review the output file for details:
less ./portstatus.txt
- The output file will provide the date the report was run, the source and target host names, a timestamp for each port tested, and the port number and status. Status is either OPEN or CLOSED.
If the time between port tests is longer than a few milliseconds, it might imply network latency. In our test lab, hosts on the same switch reply within a few milliseconds while hosts on different switches take as log as one second to respond.
Study the closed ports that are used by your specific appliance using the Network Architecture and Ports linked above as a guide. Make sure all ports used by any given appliance are OPEN.
Sample Output ofportstatus.txt
# cat ./portstatus.txt Run Date: Thu Aug 22 04:51:45 2019 Source Host: LOGHYB Target Host: 192.168.1.57
Time %H:%M:%S.%f Port #: Status ========================== 04:51:45.7011 Port 21: OPEN 04:51:45.7021 Port 22: OPEN 04:51:45.7028 **Port 25: *CLOSED* 04:51:45.7045 **Port 53: *CLOSED* 04:51:45.7051 **Port 80: *CLOSED* 04:51:45.7057 **Port 89: *CLOSED* 04:51:45.7064 Port 111: OPEN 04:51:45.7070 **Port 389: *CLOSED* 04:51:45.7077 **Port 443: *CLOSED* 04:51:45.7081 Port 514: OPEN 04:51:45.7086 **Port 636: *CLOSED* 04:51:45.7089 **Port 2049: *CLOSED* 04:51:45.7096 **Port 2888: *CLOSED* 04:51:45.7101 **Port 3888: *CLOSED* 04:51:45.7106 Port 4369: OPEN 04:51:45.7110 **Port 4505: *CLOSED* 04:51:45.7114 **Port 4506: *CLOSED* 04:51:45.7118 **Port 5181: *CLOSED* 04:51:45.7121 **Port 5432: *CLOSED* 04:51:45.7126 **Port 5660: *CLOSED* 04:51:45.7129 Port 5671: OPEN 04:51:45.7139 **Port 5900: *CLOSED* 04:51:45.7151 Port 6514: OPEN 04:51:45.7158 **Port 7005: *CLOSED* 04:51:45.7162 **Port 7007: *CLOSED* 04:51:45.7165 **Port 7050: *CLOSED* 04:51:45.7168 **Port 7054: *CLOSED* 04:51:45.7172 **Port 7220: *CLOSED* 04:51:45.7175 **Port 7221: *CLOSED* 04:51:45.7178 **Port 7222: *CLOSED* 04:51:45.7182 **Port 8080: *CLOSED* 04:51:45.7187 **Port 8140: *CLOSED* 04:51:45.7193 **Port 8443: *CLOSED* 04:51:45.7197 **Port 9001: *CLOSED* 04:51:45.7201 **Port 9443: *CLOSED* 04:51:45.7207 **Port 9997: *CLOSED* 04:51:45.7209 **Port 9998: *CLOSED* 04:51:45.7212 Port 15671: OPEN 04:51:45.7216 Port 25672: OPEN 04:51:45.7221 **Port 27017: *CLOSED* 04:51:45.7226 Port 50001: OPEN 04:51:45.7230 Port 50002: OPEN 04:51:45.7235 **Port 50003: *CLOSED* 04:51:45.7238 **Port 50004: *CLOSED* 04:51:45.7241 Port 50005: OPEN 04:51:45.7245 Port 50006: OPEN 04:51:45.7251 **Port 50007: *CLOSED* 04:51:45.7254 **Port 50008: *CLOSED* 04:51:45.7258 **Port 50009: *CLOSED* 04:51:45.7261 **Port 50010: *CLOSED* 04:51:45.7266 **Port 50020: *CLOSED* 04:51:45.7269 **Port 50022: *CLOSED* 04:51:45.7272 **Port 50025: *CLOSED* 04:51:45.7274 **Port 50030: *CLOSED* 04:51:45.7277 **Port 50035: *CLOSED* 04:51:45.7280 **Port 50036: *CLOSED* 04:51:45.7283 **Port 50040: *CLOSED* 04:51:45.7286 **Port 50060: *CLOSED* 04:51:45.7288 **Port 50070: *CLOSED* 04:51:45.7291 Port 50101: OPEN 04:51:45.7295 Port 50102: OPEN 04:51:45.7299 **Port 50103: *CLOSED* 04:51:45.7302 **Port 50104: *CLOSED* 04:51:45.7304 Port 50105: OPEN 04:51:45.7308 Port 50106: OPEN 04:51:45.7312 **Port 50107: *CLOSED* 04:51:45.7314 **Port 50108: *CLOSED* 04:51:45.7318 **Port 50120: *CLOSED* 04:51:45.7321 **Port 50125: *CLOSED* 04:51:45.7324 Port 50202: OPEN 04:51:45.7328 **Port 51113: *CLOSED* 04:51:45.7331 Port 56001: OPEN 04:51:45.7334 Port 56002: OPEN 04:51:45.7338 **Port 56003: *CLOSED* 04:51:45.7340 **Port 56004: *CLOSED* 04:51:45.7343 Port 56005: OPEN 04:51:45.7346 Port 56006: OPEN 04:51:45.7349 **Port 56007: *CLOSED* 04:51:45.7352 **Port 56008: *CLOSED* 04:51:45.7354 **Port 56020: *CLOSED* 04:51:45.7357 **Port 56025: *CLOSED* 04:51:45.7360 Port 56202: OPEN 04:51:45.7363 **Port 60000: *CLOSED* 04:51:45.7367 **Port 60006: *CLOSED* 04:51:45.7370 **Port 60007: *CLOSED* 04:51:45.7372 **Port 61614: *CLOSED* 04:51:45.7375 **Port 64000: *CLOSED* 04:51:45.7378 **Port 64001: *CLOSED* 04:51:45.7381 **Port 64002: *CLOSED* 04:51:45.7383 **Port 64003: *CLOSED* 04:51:45.7386 **Port 64004: *CLOSED* 04:51:45.7389 **Port 64005: *CLOSED* 04:51:45.7392 **Port 64006: *CLOSED* 04:51:45.7395 **Port 64007: *CLOSED* 04:51:45.7397 **Port 64008: *CLOSED* 04:51:45.7399 **Port 64009: *CLOSED*
|