Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The issue I have currently is with Windows (WindowsXP --> Windows 2003) but I would be interested also in how resolving it in a linux client.

I work with a network split in several subnetworks and there is a firewall between those that is managed by the parent company. Sometimes, when troubleshooting/installing new applications, we find that it does not work due to some port being blocked, and everytime it is a lengthy process to contact the firewall people and agree for a time for a test so we replicate the action and they check the log of the firewall.

As they are pretty much overworked and I would like some more flexibility, I would like to know if there is some way to, from the client, detect attempted connections dropped or denied by the firewall (or at least, all connections from a process/to a server so we can revise them).

I have tried logging things with wireshark, but (if it is the way) I do not know what to look for in the dump. I don't think netstat or PortView would work as these connections are not established.

share|improve this question
up vote 1 down vote accepted

There are good scanning tools like nmap that can show you what ports on a target system are reachable, and which are not.

share|improve this answer
The issue is not which ports are currently open but which ports should I open (or ask to be open) in order to get the issue resolved (v.g., a third party program that does not connect and for which I don't have proper documentation). – SJuan76 Apr 13 '11 at 13:29
Aaaa, I see. I've always worked forward with a knowledge from documentation or other sources what ports will be needed, then scanned to see if they are reachable. If your docs are good enough, you will have to watch traffic on your client using tcpdump or wireshark or etercap or other similar eves dropping tools. – Caleb Apr 13 '11 at 13:31
+1 because Wireshark is the correct answer. – dunxd Apr 13 '11 at 14:11
Ok. Before giving you the answer: Any suggestion of what I could be looking at (some filter that shows these connections)? – SJuan76 Apr 13 '11 at 16:21
I'm not a wireshark kind of fish, but it looks like you can capture a bunch of traffic starting before one of your attempts, then add some filters after the capture to find things directed at your target server. The packet details should show what ports were used, and you can even sort by protocal which should make it easy to drill down. In tcpdump I would just rig up some grep/perl stuff to see a list of ports that got hit during any given dump. – Caleb Apr 13 '11 at 16:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.