A lot of discussion I see suggests that changing default ports for services is just "security by obscurity" and is easily defeated by scanning for open ports.

My question is this, though, if the port is changed to a random port, yes an attacker knows it's open, but do they know what service is listening? And if they don't know what service is listening does that make it difficult for them to craft an attack?

Or is it the case that once the port is open, it's then trivial to find out what service is listening on it?

  • 1
    The question indicated as a duplicate does not answer my question.
    – Henry Lee
    Commented Apr 19, 2013 at 14:27
  • Google "port scanning".
    – user10211
    Commented Apr 19, 2013 at 15:32
  • A large number of services will identify themselves in some way when you connect to the port. IE nc localhost 22 returns SSH-2.0-OpenSSH_5.9p1 Debian on my system.
    – Zoredache
    Commented Apr 19, 2013 at 16:56
  • nmap has a rather neat service detection option that can detect all sorts of services and the software and versions running them, even in cases where it isn't quite as obvious as @Zoredache's example.
    – Ladadadada
    Commented Apr 20, 2013 at 8:28


Browse other questions tagged .