11

How to check whether there is a route between two hosts for a particular port (e.g. 1433).

7
  • 5
    If there is a route for one port there is a route for every port. Routing happens on a network layer without ports. Aug 7, 2013 at 4:20
  • What if there is a firewall between the two hosts and filter ports?
    – ohho
    Aug 7, 2013 at 4:24
  • 1
    @ohho: it doesn't matter. If there is a route - then it is there regardless of firewall settings. You probably need to rephrase your question.
    – zerkms
    Aug 7, 2013 at 4:25
  • 1
    Firewalls operate at a different level. @ChristopherPerrin is correct, routing occurs at the IP level, not the port level.
    – EEAA
    Aug 7, 2013 at 4:26
  • 1
    So is there any command line tool (CentOS) I can use to check the hosts are connectable via a particular port?
    – ohho
    Aug 7, 2013 at 4:28

4 Answers 4

10

with 'ip route get ADDRESS' you can check the route configured in your system, that is, the first hop:

$ ip route get 192.168.10.10
192.168.10.10 via 192.168.10.1 dev eth0  src 192.168.10.11 
    cache 

to check the port connectivity, a simple telnet should do:

$ telnet 192.168.10.10 1433
...

good luck!

7

Fisrt, you must know that, the route action occurs at Network Layer, while port is defined at Transport Layer. So If there is a route exists between two host doesn't mean you can reach a port in a host.

Imagining two host is two house, port is gate of the house, route is road. You can build many roads between houses. But when you reach a house, if the house's gate is closed, you can not come in.

UPDATE

For you comment question, you could use some command like:

To check route exists:

  • route
  • traceroute

To check open port:

  • telnet
  • netcat

Read it manpage and try using.

4
  • What (command line) tools are available to check the route existence, and the port connectivity?
    – ohho
    Aug 7, 2013 at 4:49
  • If you can find a route between the hosts with the tools then there IS a route. If there is a route you can check if the port is open with the other tools. Aug 7, 2013 at 5:08
  • telnet dst_host dst_port is the standard invocation.
    – dmourati
    Aug 7, 2013 at 6:42
  • I love the analogy of the house and gate. Sep 5, 2018 at 19:07
2

As others have mentioned, having a route doesn't necessarily mean you have connectivity. If that's what you're looking to test, netcat offers the -z option to scan to see if a port is open. (You may also wish to specify a timeout with -w if you may not have a route; the default timeout is usually a couple of minutes.)

$ nc -z 127.0.0.1 22; echo $?
0
$ nc -z 127.0.0.1 11; echo $?
1

You can use the exit code to do something (or not) based on whether you have demonstrated connectivity to that address and port:

if nc -z 127.0.0.1 22; then
    echo "SSH server is available."
else
    echo "Cannot connect to SSH server."
fi

The -v option will make the output more verbose, and this can be used to scan a range of ports:

$ nc -vz 127.0.0.1 22-25
Connection to 127.0.0.1 22 port [tcp/ssh] succeeded!
nc: connect to 127.0.0.1 port 23 (tcp) failed: Connection refused
nc: connect to 127.0.0.1 port 24 (tcp) failed: Connection refused
Connection to 127.0.0.1 25 port [tcp/smtp] succeeded!
$ echo $?
0

As shown above, in multiport scan mode the exit code will be true (0) if any of the ports succeeded in connecting, or false otherwise.

There are several different versions of netcat; the one used in the examples above is the netcat-openbsd package from Debian 9, which is a rewrite of the "traditional" netcat (netcat-traditional package). For these particular parameters and exit codes the traditional version is substantially similar. If you are having problems with netcat command line parameters and exit codes, check which version you're using; ls -l /bin/nc* may give some insight.

4
  • I am on CentOS and '-z' is not a valid option, is there an equivalent Sep 5, 2018 at 19:05
  • You don't mention which CentOS and what version of netcat you're using, but as I mention there are a number of different versions. Have you checked the package list for your system to see if you can install a different version, such as the OpenBSD netcat that I used above?
    – cjs
    Sep 6, 2018 at 2:12
  • 1
    Note, you should specify a timeout with the -G flag if the connection test is part of a condition in your scripts
    – A.J. Brown
    Nov 19, 2018 at 6:47
  • @A.J.Brown That's a good suggestion, and I've updated the post based on it. However, the timeout option in both OpenBSD and traditional netcat is -w. (OpenBSD has no -G option and for traditional that sets the source routing pointer. Welcome to the world of differing netcats!)
    – cjs
    Nov 19, 2018 at 7:39
1

I really like mtr http://www.bitwizard.nl/mtr/. There is also a windows version at http://winmtr.net/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .