Monitoring TCP ports

Utilizing a 1605, is there a MIB or another way to show amount of traffic by tcp or udp port on a particular interface?

Brian
If you want reporting on specific TCP ports and packet count is sufficient then an alternative to consider would be to create an access list and assign it to the interface (depending on your requirements you might want one access list for inbound and a similar access list for outbound). This access list would not necessarily deny anything. But it would have permit statements for the particular tcp ports that you are interested in and a permit any at the bottom. This way the access list would count packets for the TCP (or UDP) port.
An example would be this:
ip access-list extended count_in
remark count tcp packets inbound
permit tcp any any eq 23
permit tcp any any eq 80
permit tcp any eq 23 any
permit tcp any eq 80 any
permit any any
ip access-list extended count_out
remark count tcp packets outbound
permit tcp any any eq 23
permit tcp any any eq 80
permit tcp any eq 23 any
permit tcp any eq 80 any
permit any any
interface fastethernet0/0
ip access-group count_in in
ip access-group count_out out
then show access-list count_in and show access-list count_out would show the number of hits for each line and you would have packet counts for your specific TCP ports.
HTH
Rick

Similar Messages

Monitoring TCP port status

I would like to know if a tcp port is open or not. How can i do it ?

Hello IDS,
Thank you for contacting National Instruments.
I have created an example VI that expands on Stijn's response. The TCP listen will return IP and port information if the selected port is open. If it is not, the VI will time out and send an error. By putting the TCP Listen VI in a while loop and monitoring the error status, you can monitor the status of the TCP port.
You can adjust the timeout according to your needs.
I hope this helps,
Sean C.
Applications Engineer
National Instruments
Attachments:
ExampleVI.vi ‏26 KB

[SQL QUERY] Select TCP Port Monitors and their related Watcher Node

Hi everybody,
I'm working on a SSRS report and SQL Query, I have no problem to find all my TCP Port Monitor (SCOM 2012 R2) based on the DisplayName, but I can't figure out how to get their related watcher nodes (in my case only 1 computer is a watcher node).
I can't find which table, which field, contains this information..?
Here is the query i started to write (i select * since i still searching for the right column):
SELECT
FROM StateView s
INNER JOIN BaseManagedEntity me on me.BaseManagedEntityId=s.BaseManagedEntityId
INNER JOIN MonitorView mv on mv.Id=s.MonitorId
INNER JOIN ManagedTypeView mtv on mtv.Id=s.TargetManagedEntityType
--where mv.DisplayName like 'Ping Target Status Check%'
AND me.IsDeleted = '0'
where mv.DisplayName like '%tcpmon%'
and mv.LanguageCode = 'ENU'
--and s.HealthState in (@state)
ORDER BY s.Lastmodified DESC
It would be great if someone can help me !
Thanks,
Julien

Hi,
After creating a TCP port monitor, we can find a table for this monitor under operationsmanager database :
SELECT *
FROM [OperationsManager].[dbo].[MT_TCPPortCheck_******WatcherComputersGroup]
You will find the warcher computer group.
Regards,
Yan Li
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Operations Manager 2012 - TCP Port Monitor

Hi,
Is it possible to have the TCP port monitor only alert if it fails on subsequent polls, instead of the single connection failure which is the default? We have 3 GPRS connections which intermittently
fail, so we only need to be alerted if they don't come back online after a 5-10 minute inverval and 2 failed connection attempts in a row. We have orchestrator so perhaps a runbook needs to be created?
Thanks

Hi,
Yes. The Runbook could do this trick. I think you need to make the monitors not to generate alerts when health state changes. Then use runbook to monitor the Health State, if some conditions are ture, an alert will be generated.
I am not so familiar with Orchestrator, you may ask at Orchestrator to get answered of how to design the Runbook.
Juke Chou
TechNet Community Support

Monitor a TCP port but alert only if timed out X times

Hello,
I need to build a moniotr that will probe a TCP port but alert only if timed out X times
I was looking at Microsoft.SystemCenter.SyntheticTransactions.TCPPortCheckProbe module but it doesn't have this options
Thanks,
Marius

You can check
http://www.ghacks.net/2010/05/25/tcp-port-monitor-port-alert/
for TCP Port Monitor Port Alert

Create TCP port monitor to ping windows server or network device

Dears
I'm trying to create TCP port monitor which tests the ping of a remote network device or windows computer from the watcher node, but I don't know which port to use, is there a specific port number?
Thanks
Mohammad, IT NOC Team

I also would like to share the following article with you. It is a sample script that will use netstat –an to check the TCP ports currently in a listening state on the local system
and parse the output to determine that the defined TCP port is in a listening state.
http://operatingquadrant.com/2009/08/13/scom-locallly-monitoring-a-listening-tcp-port/
Niki Han
TechNet Community Support

Monitoring open ports and IP adresses on Windows clients

I'm using SCOM 2012 for monitoring system.
I cannot find how to monitor open ports (TCP, UDP) and IP addresses on Windows based PCs. I need that kind of report for Internal auditors and Security officer.
Is it possible to get Windows Firewall State, collect it in SCOM and prepare report on monthly base?
tnx in advance

I have found a possibility to do this. Hope you understand this and it is helpful. This is a two step process but guess will definitely server the purpose.
Scope: We will be running a tool which will monitor a port (TCP or UDP) for a specific host / IP and will throw a log file.
SCOM will monitor the log file and will throw a alert if the log file contains the string NOT LISTENING (Port not working or unable to open the port) which the program will create the log with the results.
First download the program named: PortQry Command Line Port Scanner Version 2.0 from microsoft using the below link. It is a command line tool.
http://www.microsoft.com/en-in/download/details.aspx?id=17148
Run it using by making a batch file or powershell script using task scheduler as per your time requirement (Every 5 min or 1Hr).
Use this command to monitor a ip / hostname and its port with TCP or UDP.
I have pasted the command file of the program in C:\Port_checker directory so i am using the below syntax
C:\Port_checker\PortQry.exe -N 192.168.1.1 -e 5723 -p UDP -l C:\Port_checker\Result.log /y
-N = Hostname / FQDN of agent or Ip address
-E = Port # what you want to monitor
-P = Protocol (TCP or UDP)
-L = Generate log on the following location and name
/Y = To replace the existing log file name to fresh one without prompt.
The result in the log file will be as follows:
============================
For successful port open:
PortQry Version 2.0 Log File
System Date: Tue Oct 07 09:42:32 2014
Command run:
C:\PortQryV2\PortQry.exe -N 192.168.1.1 -e 5723 -p UDP -l C:\Portqryv2\Result.log /y
Local computer name:
192.168.1.2
Querying target system called:
192.168.1.1
Attempting to resolve name to IP address...
Name resolved to 192.168.1.1
querying...
UDP port 5723 (unknown service): LISTENING
========= end of log file =========
PortQry developed by Tim Rains
For failure port open:
PortQry Version 2.0 Log File
System Date: Tue Oct 07 09:42:32 2014
Command run:
C:\PortQryV2\PortQry.exe -N 192.168.1.1 -e 5723 -p UDP -l C:\Portqryv2\Result.log /y
Local computer name:
192.168.1.2
Querying target system called:
192.168.1.1
Attempting to resolve name to IP address...
Name resolved to 192.168.1.1
querying...
UDP port 5723 (unknown service): NOT
LISTENING
========= end of log file =========
PortQry developed by Tim Rains
Now as per the above results NOT LISTENING Port is blocked or is not opened and LISTENINGmeans
working or port is opened.
So now using SCOM you will monitor the log file Result.log in the location C:\Port_checker\ saying
if NOT LISTENING comes in the log file throw me a alert in SCOM consle or via email.
To configure that alert you need to create a Generic text log alerting Rule which will throw a alert if any thing added in that log which is not to be added and if it is added like NOT
LISTENING then it will throw a alert.
Refer this link on how to open a Generic text log alerting Rule.
http://blogs.technet.com/b/kevinholman/archive/2009/06/20/using-a-generic-text-log-rule-to-monitor-an-ascii-text-file-even-when-the-file-is-a-unc-path.aspx
Gautam.75801

Selector.open() uses two TCP ports on Windows

As part of a security review, we are monitoring the ports opened by our application (which uses NIO) using TCPView on Windows Vista Business with sp1.
I ran the NIO test below.
public class NioSelectorMain {
public static void main(String[] args) throws Exception {
Selector selector = Selector.open();
System.out.println(selector);
Thread.sleep(Integer.MAX_VALUE);
Example output is:
sun.nio.ch.WindowsSelectorImpl@b1c5fa
TCPView showed the following two ports opened - the numbers change each time obviously, but there are always two ports.
javaw.exe:8224 TCP aled-PC:50741 localhost:50742 ESTABLISHED
javaw.exe:8224 TCP aled-PC:50742 localhost:50741 ESTABLISHED
I've tried this with sun jdk1.6.0_05 and jdk1.5.0_14. When running the same test on Linux, no ports are opened.
Why are these ports used, and is there any way to either prevent them from being opened or to specify which ports should be used?
Thanks in advance, Aled

Thanks for the very prompt reply!
or to specify which ports should be used?Why would you want to do that?Our enterprise customers would like to know which ports will be used so that they can lock down the machine as much as possible, and can better detect malicious programs/usage.
I presume by "why would you want to do that" that it's not possible?

Automate build TCP port checks in SCOM 2012 using template?

Hi, I would like to leverage Orchestrator to build TCP port checks from customer requests.
ie, Customer requests Port X on server Y be checked. Orchestrator to kick off script to generate the require entries in SCOM2012 allow the TCP port check to be dynamically built.
Cannot see anything that would assist with this.
Can anyone help?
Thanks, Thomas

For Create custom TCP Port Monitoring, you can refer to below links
http://www.systemcentercentral.com/custom-tcp-port-monitoring-management-pack-for-scom-2012/
http://technet.microsoft.com/en-us/library/hh457544.aspx
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer".

How to get the number of bytes at TCP port

Hi all,
How to get the number of bytes to read at the TCp port...as someone had suggested in some forum we do read the number of bytes first and then pass this...
but we get a problem when we have FF data in this...because then it sends 2 FF data...and cause of this we skip the last data...is there any solution for the same?

Hi
In LabVIEW you don't have the same property as in serail port.
You havn't "Byte at TCPIP port".
if you developp a protocol, one soltion, is to send the size to read.
Ingénieur d'Application / Développeur LabVIEW Certifié (CLD)
Application Engineer / LabVIEW Certified Developer (CLD)

Bypassing TCP port 25 restriction (i.e. worst ISP EVER; Mail is not allowed

Hi
The private company that runs my DOES NOT ALLOW Smtp connections on its "hi speed internet connection".
Meaning that Mail cannot function and I have to check via webmail.
I'm serious.
Their FAQ states:
Can I use email clients such as Microsoft Outlook or Outlook Express to send and receive emails?
No, you will only be able to use web browser based email such as Hotmail or Gmail; this is due to limitations (on TCP port 25) which have been implemented to protect you against other computer users sending unsolicited bulk emails (SPAM) via your computer.
Does anyone know a way to get around this as I NEED the functionality of Mail.....
Also,
Are all British ISPs this ridiculous?
Dieing to find a solution to this....... Many Many Many Many Thanks
PS. I already paid extra ($250USD) to enable 'super' internet which doesnt throttle VOIP, STREAMING, gaming, P2P etc.
Luke

Beginning January 1, 2006 Port 587 has been standardized as the port to use for authenticated SMTP servers although most will still work with Port 25 as well. More and more ISPs are blocking port 25 as various jurisdictions are holding them responsible for spam and/or viruses originating on their network. With unauthenticated SMTP anyone can send using that server whether they have an account or not. So the ISPs block that port with the sole exception of their own SMTP server so they can scan the messages for spam and viruses. With an authenticated SMTP server where a valid account id and password are required to send messages the provider of the server assumes the responsibility for scanning all traffic through their server thus relieving the ISP of the liability.
Whether you think this is a big brother step or not, with estimates that spam on the internet is running as high as 70% of all email traffic, if it weren't for restrictions like this email would rapidly become an unusable tool. The only annoying thing I have found about this is how few ISP Tech Support people know about this. To often their solution is "you can only use another email provider through their webmail interface."

ACS 5.5 SFTP repository non-standard TCP port

is it possible to change the TCP port in a SFTP repository from 22 to something different ?
like this is not working
repository sftp1
url sftp://10.10.0.8:22222/user1
user user1 password hash bc14bc179d2708cc31cbc22ee6a679cd22c095a1

There is not much information inside the defect. We've been seeing different customer's experiencing this issue.
Symptom:
SFTP stops working after upgrading to ACS 5.5
Conditions:
once we upgrade to ACS 5.5
Workaround:
NA
Try this one, this should work
https://tools.cisco.com/bugsearch/bug/CSCum93359/?reffering_site=dumpcr
Regards,
Jatin
**Do rate helpful posts**

Http probe on non-standard tcp port 8021

I've configured http probe on standard port 80 with no issue. I'm now trying http probe on non-standard tcp port 8021, confirmed with packet capture to confirm that the CSM is indeed probing, status code 403 is returned but the reals are showing "probe failed". Am I missing something? Thank you in advance.
CSM v2.3(3)2
probe 8021 http
request method head
interval 2
retries 2
failed 4
port 8021
serverfarm TEST
nat server
no nat client
real 10.1.2.101
inservice
real 10.1.2.102
inservice
probe 8021
vserver TEST
virtual 10.1.2.100 tcp 8021
serverfarm TEST
replicate csrp connection
persistent rebalance
inservice
VIP and real status:
vserver type prot virtual vlan state conns
Q_MAS_8021 SLB TCP 10.1.2.100/32:8021 ALL OUTOFSERVICE 0
real server farm weight state conns/hits
10.1.2.101 TEST 8 PROBE_FAILED 0
10.1.2.102 TEST 8 PROBE_FAILED 0

you need to specify what HTTP response code you expect.
The command is :
gdufour-cat6k-2(config-slb-probe-http)#expect status ?
<0-999> expected status - minimum value in a range
The default is to expect only 200.
This is why your 403 is not accepted.
Gilles.

Does an ADC Adapter Power Monitor USB Ports?

I'm planning to pick up a Mini in the near future, and was hoping to squeeze another year or two of life out of my Cube's display. Was curious if anyone knows whether any of the various DVI-ADC Adapters (Apple's or a third party's) supplies the extra power to the monitor USB ports that is required to drive cube speakers?
It'd be a nice bonus (and extra reason not to buy a new display right away) if I got to keep using my Cube speakers with a Mini.

If you purchase Apple's adapter it should do everything you are looking for.
-Juxel

Qosmio F10 Monitor in port wiring

Hi all,
Anyone know the pin functions on the monitor in port on an F10. I can't find anyone who can sell me a lead so I need the pin functions to make up a lead for video and audio.
Thanks
Tony

Hey Tony,
Why do you want to know this information? I think such informations you can only find in the technical manual of the notebook but these manuals are only available for ASPs and Toshiba I think. You can only download the user manual.
You should ask an ASP for help. Maybe the technicians can help you.
By the way, have you some troubles with the notebook?

Monitoring TCP ports

Similar Messages

Maybe you are looking for