Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking for a tool that I can use within a firewalled network to scan the firewall to find open outgoing ports.

I've done some research and found Firewalk but it hasn't been maintained in 10 years, and didn't seem to work for me when I tried it.

I did some googling and found some sites saying you can do this with nmap, but I couldn't get this working either.

Does anyone know of a better way than setting up a box outside the firewall listening on every port and trying to port scan it from the inside?

share|improve this question
add comment

5 Answers

Say you have three subnets and a server on one of them, but want to see what rules are open to the other two. I run a nmap scan against the other two from the server. I typically use this line:

nmap -v -oA `hostname`_full-nmap-`/bin/date +%y%m%d` -P0 -sS -F -n --host_timeout 240000 --max_rtt_timeout 300 --initial_rtt_timeout 2000 --max_parallelism 250 192.168.123.0/24 192.168.234.0/24

You could apply a similar concept routing to the Internet as well, as nmap will identify what ports are filtered.

share|improve this answer
add comment

Firebind.com provides this service.

It lets you test your outbound connectivity over an arbitrary range of UDP or TCP ports. Testing ranges larger than 100 ports requires a free account.

share|improve this answer
3  
Do you work for them? –  jscott May 1 '12 at 18:16
add comment

Here is what I did:

Set up one machine in the network under test, and one elsewhere on the Internet (on the other side of the firewall). You should be fine using windows or linux (I used CentOS). I had a public IP but I guess it would work with a 1:1 NAT.

On the internet machine, I ran a command which would open every port on my computer with nc. I did

for i in `seq 1 65000`; do nc -l $i &; sleep 1; done

The sleep is there to prevent it from spawning an excessive number of netcat processes at once. It went fine but took 65000 seconds (overnight).

On the tested network, I simply run

nmap -p- -PN <IP>

and wait for the results.

share|improve this answer
    
Welcome to serverfault! I've edited your answer to make it fit the style of other answers more closely; feel free to click edit yourself to see the markdown. Note that the grave character (`) is used to denote code sections, so using it as an apostrophe (') confuses the markdown engine :) –  Falcon Momot May 23 '13 at 21:36
add comment

Because you need something to reply on those ports your idea of having a machine on each side of the firewall is the best. Without that target machine the port may be open on the firewall itself but because it won't (shouldn't?) respond to traffic on that port you would be unaware of it. Is such a situation you would be unable to tell the difference between the port being closed with firewall simply dropping the packets or the port being open but nothing on the other end to respond.

share|improve this answer
add comment

Will strobe do it? http://www.cerias.purdue.edu/about/history/coast/archive/data/categ50.html

I've had good results with nmap.

Edited to correct "namp" to "nmap"

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.