Browse Live Discover and Response Queries by Category
Under Review

Checking open ports on servers

Hi,

I am wondering is there any way we can view what ports are open on each server, I mean not through firewall rules.

Reem Jalal Eddine

  • Hi Reem,

    Thanks for reaching out to the Sophos Community Forum.  With Sophos Live Discover, it is possible to run a query for this information from Sophos Central. 

    The following query will show you the currently open/active network sockets on the given device.

      

    SELECT (
  CASE family 
  WHEN 2 THEN 'IP4' 
  WHEN 10 THEN 'IP6' 
  ELSE family END
) AS family, (
  CASE protocol 
  WHEN 6 THEN 'TCP' 
  WHEN 17 THEN 'UDP' 
  ELSE protocol END
) AS protocol, local_address, local_port, 
  remote_address, remote_port 
FROM process_open_sockets 
WHERE family IN (2, 10) 
AND protocol IN (6, 17)
     

    In addition to data/tables specific to Sophos, Live Discover uses the open-source Osquery Schema to give you access to additional tables.
    You can find more information on this in the following link.
    - Sophos Schema

    I found the query mentioned above on the following page.
    - Network Socket Monitoring with OSquery

Unfiltered HTML