1

We have a large network with many servers. What is the easiest way to find all the servers that are Internet facing? Manually checking each server is not an option.

Improve this question
1
  • 1
    Define "internet facing".
    – joeqwerty
    Nov 3, 2011 at 18:26

3 Answers 3

Reset to default
6
  • Run nmap from the outside against all your address space?
  • Examine the rule set on your firewall/border device to see what is permitted.
  • Monitor traffic on your firewall/border device for a while and see what is being accessed?

You should probably do all of the above, and once you find the results, add it to your documentation, that will be maintained. Once you find the results from the above, you would dig deeper, and check to see if the permitted traffic is going to some kind of device that is proxying or otherwise permitting traffic to other devices.

Improve this answer
1
  • 1
    I concur - the first step should be examining your firewall configuration. After that, trace physical connections from the ISP termination point (pizza box, etc) that do NOT terminate at the firewall.
    – Driftpeasant
    Nov 3, 2011 at 18:49
1

I would check with my CMDB or other documentation.

Failing that, you'll have to define "internet-facing" (responds to inbound requests only? Can get out to the internet on its own?) ... and then check each one. Not from the outside, either. What if you have a public DNS name that points to a cluster of LB and that has 30 servers behind it? From the outside, you'll never be able to tell what server you've hit, unless the server puts its name in the application payload somehow - over HTTP, this could be an X-header. Although it would probably be a bad idea if it did.

If you have a single device that can capture all internet traffic, you could parse the logs, but that will only tell you what servers talked, it would miss any servers that weren't hit during the log timeframe.

Improve this answer
1

If you aren't just trying to figure out how to break into someone else's network, you should be able to work it out if you gather the following information:

You should at least know which devices have a physical connection to the internet, by whatever means, and hopefully some controlled points of entry (1 or more firewalls). Looking at the configuration on those may help.

You should be able to find out the public IP addresses assigned to your network - that is somewhere else to check. Reverse DNS lookups of these, both public and internal, should give some clues.

Are you using NAT on your network? If so, then somewhere you must be mapping traffic from the internet through NAT to the servers. Check the config for that.

If you are just trying to break into a network, then you will probably find more help in other fora.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .