Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Googling a port and protocol leads to a terse description at best, and a linkfarm in the average case. Most protocols on assorted, unknown high ports contain little or no plaintext, and often if the IDS trips in the middle of a session I don't even see the session setup.

There are useful lists of file signatures denoting different filetypes. I've never seen something like this for protocols above the transport layer, besides perhaps the one built into Wireshark.

Does anyone know of a good information source for this?

Another option would be a machine learning classifier for network data. I've seen papers describing them, and seen projects to build one start, but never found one at a usable stage of development.

share|improve this question
    
High numbered ports are usually randomly picked (I think) for the likes of RPC calls. Are you looking for ranges of ports to figure out what services are doing the call? Otherwise you might need to do packet/content inspection. –  Steve Dec 8 '10 at 23:04
    
Msrpc and Sun rpc do use high ranges, but I see a lot of consistent ports outside these ranges with a lot of traffic. –  user502 Dec 9 '10 at 0:20
    
How much control do you have over the network? I.e., are you authorized to do something like an authenticated vulnerability scan of the system in question? –  Scott Pack Dec 9 '10 at 3:18

3 Answers 3

I would start with IANA's list here. Next I would investigate the host(s) in your network that the traffic is flowing to/from to try to determine the application that is responsible for the traffic. If you find it in the IANA list then this is just a verification step. If the traffic is consistent and not malicious you should be able to figure out what application is receiving/generating the traffic using netstat on the host.

share|improve this answer

Let's see, this should be easy: read a good paper like Offline/Realtime Traffic Classification Using Semi-Supervised Learning

Then maybe mix in some knowledge from wholly understanding a single read through Statistical Techniques for Network Security (cheap, only $160 on amazon)

Then fire up your favorite text editor and code a little, but utilize RapidMiner or Weka because, well, coding those algorithms is too easy.

Finally spend a couple hours tuning up the algorithms and then your all set.


Sarcasm aside, the steps above outlines an academically popular way to creatively solve a lot of hard problems in security. I wish I could say I could do the above proficiently - maybe you can write a tool to do it!

share|improve this answer
    
Tate, that's actually an answer I'd considered. What gives me pause is that I've seen several projects start down that road, but haven't seen any make it to the "useful results" phase--which in the anthropic sense means it's more difficult than it looks. –  user502 Dec 9 '10 at 13:09
    
Nice relevant link I saw come across twitter today: chem-eng.utoronto.ca/~datamining/dmc/data_mining_map.htm –  Tate Hansen Dec 9 '10 at 17:44

We use Amap from The Hacker's Choice. If someone tries to obfuscate a service by changing its port number Amap will identify it. If it's a protocol Amap doesn't know about then you're still SOL.

http://freeworld.thc.org/thc-amap/

Amap is a next-generation tool for assisting network penetration testing. It performs fast and reliable application protocol detection, independant on the TCP/UDP port they are being bound to.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.