Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a large network with many servers. What is the easiest way to find all the servers that are Internet facing? Manually checking each server is not an option.

share|improve this question
Define "internet facing". – joeqwerty Nov 3 '11 at 18:26
  • Run nmap from the outside against all your address space?
  • Examine the rule set on your firewall/border device to see what is permitted.
  • Monitor traffic on your firewall/border device for a while and see what is being accessed?

You should probably do all of the above, and once you find the results, add it to your documentation, that will be maintained. Once you find the results from the above, you would dig deeper, and check to see if the permitted traffic is going to some kind of device that is proxying or otherwise permitting traffic to other devices.

share|improve this answer
I concur - the first step should be examining your firewall configuration. After that, trace physical connections from the ISP termination point (pizza box, etc) that do NOT terminate at the firewall. – Driftpeasant Nov 3 '11 at 18:49

I would check with my CMDB or other documentation.

Failing that, you'll have to define "internet-facing" (responds to inbound requests only? Can get out to the internet on its own?) ... and then check each one. Not from the outside, either. What if you have a public DNS name that points to a cluster of LB and that has 30 servers behind it? From the outside, you'll never be able to tell what server you've hit, unless the server puts its name in the application payload somehow - over HTTP, this could be an X-header. Although it would probably be a bad idea if it did.

If you have a single device that can capture all internet traffic, you could parse the logs, but that will only tell you what servers talked, it would miss any servers that weren't hit during the log timeframe.

share|improve this answer

If you aren't just trying to figure out how to break into someone else's network, you should be able to work it out if you gather the following information:

You should at least know which devices have a physical connection to the internet, by whatever means, and hopefully some controlled points of entry (1 or more firewalls). Looking at the configuration on those may help.

You should be able to find out the public IP addresses assigned to your network - that is somewhere else to check. Reverse DNS lookups of these, both public and internal, should give some clues.

Are you using NAT on your network? If so, then somewhere you must be mapping traffic from the internet through NAT to the servers. Check the config for that.

If you are just trying to break into a network, then you will probably find more help in other fora.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.