0

Does a service, for example, SSH, generate traffic when only listening (e.g. does it advertise itself in some way) when there is no connection established?

I ask as on Android devices for example, we can monitor incoming and outgoing traffic, great - we can block specific requests, IPs, app permissions etc. but even when doing this, could there be a service listening in the background (hidden in the firmware) such that the device can be accessed? Then all the monitoring/blocking would not be an effective defense, if the service generates no traffic (or even very little such that it is not noticed).

1

Does an open port generate traffic

No, only a connected port generates traffic. An open port is just one that will respond if you talk to it.

Is it possible to detect open ports locally

On Linux, the command netstat -tupln will show the listening ports, and the associated processes.

Is it possible to detect open ports remotely

If the port is TCP, and open to anyone then you can detect it by checking for the 3 way handshake.

If it uses UDP, it is only checkable if it responds, either with a port unreachable message, or data. If the traffic is just dropped you cannot tell if this was because ICMP is blocked, or if your message just didn't get a reply.

  • Thanks - does this imply that if I look for programs listening on a given port, without root (sudo), then a program could be running (under root) and listening without my knowledge? – sumade May 25 '18 at 11:42
  • You can see that something is listening, but you won't be able to tell what – jrtapsell May 25 '18 at 12:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.