8

Googling a port and protocol leads to a terse description at best, and a link farm in the average case. Most protocols on assorted, unknown high ports contain little or no plain text, and often if the IDS trips in the middle of a session I don't even see the session setup.

There are useful lists of file signatures denoting different file types. I've never seen something like this for protocols above the transport layer, besides perhaps the one built into Wireshark.

Does anyone know of a good information source for this?

Another option would be a machine learning classifier for network data. I've seen papers describing them, and seen projects to build one start, but never found one at a usable stage of development.

Improve this question
3
  • High numbered ports are usually randomly picked (I think) for the likes of RPC calls. Are you looking for ranges of ports to figure out what services are doing the call? Otherwise you might need to do packet/content inspection.
    – Steve
    Dec 8, 2010 at 23:04
  • Msrpc and Sun rpc do use high ranges, but I see a lot of consistent ports outside these ranges with a lot of traffic.
    – user502
    Dec 9, 2010 at 0:20
  • How much control do you have over the network? I.e., are you authorized to do something like an authenticated vulnerability scan of the system in question?
    – Scott Pack
    Dec 9, 2010 at 3:18

3 Answers 3

Reset to default
4

Let's see, this should be easy: read a good paper like Offline/Realtime Traffic Classification Using Semi-Supervised Learning

Then maybe mix in some knowledge from wholly understanding a single read through Statistical Techniques for Network Security (cheap, only $160 on amazon)

Then fire up your favorite text editor and code a little, but utilize RapidMiner or Weka because, well, coding those algorithms is too easy.

Finally spend a couple hours tuning up the algorithms and then your all set.

Sarcasm aside, the steps above outlines an academically popular way to creatively solve a lot of hard problems in security. I wish I could say I could do the above proficiently - maybe you can write a tool to do it!

Improve this answer
2
  • Tate, that's actually an answer I'd considered. What gives me pause is that I've seen several projects start down that road, but haven't seen any make it to the "useful results" phase--which in the anthropic sense means it's more difficult than it looks.
    – user502
    Dec 9, 2010 at 13:09
  • Nice relevant link I saw come across twitter today: chem-eng.utoronto.ca/~datamining/dmc/data_mining_map.htm
    – Tate Hansen
    Dec 9, 2010 at 17:44
3

I would start with IANA's list here. Next I would investigate the host(s) in your network that the traffic is flowing to/from to try to determine the application that is responsible for the traffic. If you find it in the IANA list then this is just a verification step. If the traffic is consistent and not malicious you should be able to figure out what application is receiving/generating the traffic using netstat on the host.

Improve this answer
3

We use Amap from The Hacker's Choice. If someone tries to obfuscate a service by changing its port number Amap will identify it. If it's a protocol Amap doesn't know about then you're still SOL.

http://freeworld.thc.org/thc-amap/

Amap is a next-generation tool for assisting network penetration testing. It performs fast and reliable application protocol detection, independant on the TCP/UDP port they are being bound to.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .