UpGuard scans for open ports and if an open port is found, we attempt to identify the service that is running on that port. While open ports aren't necessarily dangerous, they can expose vulnerable services that are misconfigured, unpatched, vulnerable to exploits, or have poor network security.
UpGuard identifies and monitors for over 150 known services that can be exposed by open ports. If we are unable to identify a service, a risk is still raised and reported as an exposed unknown service.
The services UpGuard identifies via port scanning are:
- AMQP: Advanced Message Queue Protocol - provides access to a queue of data
- AndroMouse: Android mouse and keyboard interface
- Apache CouchDB: An open-source No-SQL database
- Apache Kafka: A real-time data streaming platform
- Apple Airport: AirPort Wifi support/service
- Apple Remote Desktop: Remote Desktop for Apple products
- BACnet: BACnet is a communications protocol for Building Automation and Control (BAC) networks
- Beanstalk Daemon: Beanstalk is a simple, fast work queue
- BGP: Border Gateway Protocol (BGP) is a standardized exterior gateway protocol designed to exchange routing and reachability information
- Bitcoin Daemon: Runs on a Bitcoin node
- Blackshades C&C: Blackshades is the name of a malicious RAT (remote access trojan)
- Cassandra DB: Apache Cassandra is a free and open-source, distributed, wide column store, NoSQL database management system
- CheckPoint Firewall: Get hostnames for the CheckPoint firewall and management station
- Cisco Install: An access point for Cisco Smart Install feature
- Citrix ICA: Citrix ICA is a proprietary protocol for an application server system
- ClamAV: An open source antivirus engine for detecting trojans, viruses, malware & other malicious threats
- CoAP: CoAP is a service layer protocol allowing nodes on a constrained network to be accessed over the internet
- Coffee Status: This is a smart coffee machine
- Coffee Machine: This is a coffee machine or kettle
- ConsulDiscovery: Consul is a service discovery solution
- Crestron SSN: Crestron is a control system for building management
- DarkTrack RAT: Another malicious RAT (remote access trojan)
- DB2: IBM DB2 database server
- DHCP: DHCP server interface
- DHT Peer List: Allows peer discovery using a distributed hash table
- DICOM: DICOM provides an interface for handling, storing, receiving of medical imaging data
- Dictionary: Dictionary server using the DICT protocol
- Digi Realport: Digi Realport (IoT wifi interfacing device) interface service
- DNP3: DNP3 is a set of communications protocols used between components in process automation systems
- DNS: Domain Name System - nuts and bolts of the internet
- Door Controller: VertX/Edge door controller
- Dovecot Pigeonhole: Pigeonhole adds support for the Sieve language (RFC 5228) and the ManageSieve protocol (RFC 5804) to the Dovecot Secure IMAP Server
- DVR SerialNo: Interface directly to a Dahua DVR device
- Echo: A service in the Internet Protocol Suite that can be used for DoS attacks
- ElasticSearch: Elasticsearch is a search engine based on the Lucene library. It provides a distributed, multitenant-capable full-text search engine with an HTTP web interface and schema-free JSON documents
- Erlang: A general-purpose, concurrent, functional programming language, and a garbage-collected runtime system
- ETCD: A distributed, reliable key-value store for the most critical data of a distributed system
- Ethereum: Ethereum is both a cryptocurrency and a decentralized computing platform.
- Ethernet/IP: Ethernet/IP is an industrial network protocol that adapts the Common Industrial Protocol to standard Ethernet
- Flux LED State: Control interface of a Flux LED light bulb.
- FTP: The File Transfer Protocol (FTP) is a standard network protocol used for the transfer of computer files
- FTP (Anonymous): The File Transfer Protocol (FTP) is a standard network protocol used for the transfer of computer files
- Ganglia XML Grid monitor: Ganglia is a scalable, distributed monitoring tool for high-performance computing systems, clusters, and networks
- Gardasoft Controller: High intensity LED lighting controller
- Gearman queue: An open-source application framework designed to distribute appropriate computer tasks to multiple computers
- GE SRTP Status: The GESRTP DAServer provides access to data within the GE Fanuc family of PLCs.
- Gh0st RAT: Another malicious RAT (remote access trojan)
- Git: Git is a distributed version control system
- GRPS Tunnel: A group of IP-based communications protocols used to carry general packet radio service (GPRS) within GSM, UMTS, and LTE networks
- HARTIP: Allows HART automation device data to be accessed over IP networks
- HBaseDB: Apache HBase™ provides random, realtime read/write access to your Big Data
- HDD Temp: Hard Drive statistics information
- HiFly Lighting Control: Control interface of a HiFly LED lighting system
- HTTP: Standard internet HTTP protocol
- HTTPS: Standard, encrypted internet HTTP protocol
- z/OS NJE: An NJE network is comprised of nodes that can transmit or receive a unit of work
- IDENTD: An Internet protocol that helps identify the user of a particular TCP connection
- iDevice Property List: Get property data from an iDevice
- IEC-104: IEC-104 is a standard for telecontrol equipment and systems with coded bit serial data transmission in TCP/IP
- IEC-61850: IEC-61850 is an object-oriented control-system protocol as compared to older protocols which are signal-oriented
- IKE VPN: VPN implementation based on IKE (Internet Key Exchange)
- IMAP: IMAP mail service
- IOTA: IOTA is a quantum-resistant distributed ledger protocol and digital currency.
- IPMI: IPMI defines a set of interfaces for out-of-band management of computer systems and monitoring of their operation
- ISCSI: Allows SCSI commands to be sent over TCP/IP
- Java RMI: Java's Remote Method Invocation interface
- Kerberos: A ticket-based node identity protocol for mutual authentication
- KilerRAT C&C: Another malicious RAT (remote access trojan)
- KNX: KNX is a manufacturer-independent protocol for networking home and building system technologies
- Lantronix Setup: Enables comms either computer - serial device, or from a serial device - another over Ethernet or Internet using “serial tunneling.”
- LDAP: TCP/IP based directory service
- LDAP SSL: TCP/IP based directory service
- LibreOffice Impress: Allows remote control of an Impress slideshow via a mobile device
- Lotus Notes: Various ports for Lotus Notes servers
- Matrikon OPC: OPC provides a mechanism for reading industrial device configuration data over TCP/IP
- MDNS: Multicast DNS service
- memcached: A distributed memory object caching system
- Microsoft Windows RPC: Microsoft RPC (Microsoft Remote Procedure Call) is a modified version of Distributed Computing Environment / Remote Procedure Calls
- Minecraft: Running a Minecraft server
- Mitsubishi EQ PLC: Programmable logic controller used for industrial automation
- Modbus: Modbus is a serial communications protocol for use with its programmable logic controllers (PLCs)
- Monero: Monero is a decentralized cryptocurrency, meaning it is secure digital cash operated by a network of users
- MongoDB: MongoDB is a document-oriented NoSQL database
- Moxa Nport: The Nport is a serial device server, providing a TCP/IP interface to one or more serial devices
- MQTT Broker: An MQTT broker is a server that receives MQTT messages from clients and then routes the messages to appropriate destinations
- MSA Outlook: Microsoft Outlook email service
- Munin Node: Munin is an open-source computer system monitoring, network monitoring, and infrastructure monitoring software application
- Mumble: Mumble is a voice over IP application primarily designed for use by gamers
- MySQL: MySQL is an open-source relational database
- NanoCore RAT: NanoCore is a trojan
- NAT-PMP: NAT-PMP is a network protocol for establishing network address translation (NAT) settings and port forwarding configurations
- NetBIOS: NetBIOS provides services allowing applications on separate computers to communicate over a local area network
- NetMobility: NetMobility is an LTE network monitoring product
- Network News: NNTP is the protocol used to connect to Usenet servers and transfer newsgroup articles between systems over the Internet
- NFS: Network File System (NFS) is a distributed file system protocol
- njRAT C&C: njRAT, also known as Bladabindi, is a trojan
- NTP: Network Time Protocol (NTP) is a networking protocol for clock synchronization
- Nuclear RAT: Nuclear RAT is a trojan
- Omron PLC: Omron PLC is a programmable logic controller
- Onvif Camera: ONVIF is a camera interface
- OPC UA: OPC Unified Architecture is a machine to machine communication protocol for industrial automation
- OpenVPN: OpenVPN is open source commercial VPN software
- Oracle TNS Listener: TNS is a protocol for connecting to Oracle databases
- pcAnywhere Status: pcAnywhere is remote control software from Symantec
- PC WORX: PC WORX is software for programming Phoenix Contact electronics devices
- PLC5: PLC-5 is a programmable logic controller from Rockwell Automation
- PLC ProConOs: ProCon OS is a protocol for programmable logic controllers
- Poison Ivy RAT: Poison Ivy is a trojan
- POP3: POP3 is a client/server protocol for email
- portmapper: Portmap returns a list of running processes and their ports on a node
- PostgresSQL: PostgreSQL is an open-source relational database
- Poppassd: Poppassd is a program that changes system passwords thus allowing users to change their mail passwords
- PPTP: The Point-to-Point Tunneling Protocol is an obsolete method for implementing virtual private networks
- Printer: This is a networked printer
- Printer Status: This is a networked printer
- QRAT C&C: QRAT is a botnet command & control server
- QUIC HTTP: QUIC is a proposed replacement for TCP to improve the speed of HTTP traffic
- Redis: Redis is a key-value database
- Red Lion HMI: Red Lion HMI devices running CrimsonV3. Red Lion's HMI operator panels enable customers to control processes across a range of industries
- RemCos Pro RAT: RemCos Pro is a remote access/keylogger tool
- Remote Desktop: RDP is Microsoft's remote desktop protocol
- Riak: Riak is a key-value database
- RIP: RIP is the Routing Information Protocol
- rpcbind: rpcbind can list active RPC services on a machine
- RSYNCD: Rsync is a utility for synchronizing local and remote directories
- RTSP: The Real-Time Streaming Protocol (RTSP) is used to control multimedia streaming, such as from IP cameras or DVRs
- RTXP Ripple: Ripple is a cryptocurrency
- S7: S7 is a proprietary protocol developed by Siemens for communicating with their Programmable Logic Controllers
- SAProuter: SAProuter is used to establish a remote connection between SAP and a customer's network
- SCPI: Standard Commands for Programmable Instruments (SCPI) is a protocol primarily used for communicating with lab equipment
- SIP: Session Initiation Protocol (SIP) is a signaling protocol used for initiating, maintaining, and terminating real-time sessions that include voice, video, and messaging applications
- Smart Meter: Kamstrup Smart Meter for metering energy and water
- Samba: Server Message Block (SMB) is a protocol for shared access to files, printers, and serial ports between nodes on a network
- SMB: Server Message Block (SMB) is a protocol for shared access to files, printers, and serial ports between nodes on a network
- SMTP: Simple Mail Transfer Protocol (SMTP) is a protocol used for sending email
- SNMP: Simple Network Management Protocol (SNMP) is a protocol for collecting information from and configuring various types of networked devices
- SQLServer Monitor: Microsoft SQL Server is a relational database
- SQLServer: Microsoft SQL Server is a relational database
- SQL Server: Microsoft SQL Server is a relational database
- SSH: Secure Shell (SSH) is a protocol for securely operating network devices
- StatsD: StatsD Is a daemon for collecting statistics
- Steam: Steam-based dedicated server for online gaming
- Subversion: Apache Subversion is a software versioning and revision control system distributed
- TACACS+ AAA: Check whether the device supports TACACS+ AAA
- Tank Gauge
- TC-B: TC-B service
- TeamViewer: Team Viewer service
- Telnet: Telnet is an application protocol used on the Internet or local area network to provide a bidirectional interactive text-oriented communication facility using a virtual terminal connection
- Tibia: Tibia (video game) service
- TOR Control: Tor Control Service
- TOR OR: Tor Onion Router
- Torrent Tracker: BitTorrent tracker service
- IBM/Toshiba 4690 POS: Service for remote management of the IBM / Toshiba 4690
- Tridium FOX: FOX protocol by Tridium
- TUYA API: Tuya API service
- Ubiquiti: Service for retrieving information about a Ubiquiti-powered access point
- Udpxy: UDPXY service (IPTV stream relay)
- Unitronics PLC PCOM: Service for collecting device information for Unitronics PLCs via PCOM protocol
- Unknown: Service for collecting device information for Unitronics PLCs via PCOM protocol
- UPnP: UPnP Service
- Ventrilo: Service for retrieving detailed status information from a Ventrilo server
- VNC: Virtual Network Computing is a graphical desktop sharing system that uses the Remote Frame Buffer protocol to remotely control another computer
- VoldemortDB: Voldemort is a distributed data store that was designed as a key-value store used by LinkedIn for highly-scalable storage
- VxWorks WDB agent: WDB agent (used for debugging) on a VxWorks device
- Web cache: A Web cache (or HTTP cache) is an information technology for the temporary storage (caching) of Web documents, such as Web pages, images, and other types of Web multimedia, to reduce server lag
- Oracle WebLogic T3: T3 is the protocol used to transport information between WebLogic servers and other types of Java programs
- Wemo Link: Wemo Link service
- WHOIS: WHOIS service
- X11: X11 service running, and with the ability to grab the resulting banner with no auth
- XMPP Daemon: Extensible Messaging and Presence Protocol service
- Yahoo Smart TV: A port is open and a service is listening but we cannot identify it
- Zookeeper Node: A port is open and a service is listening but we cannot identify it
- Apple RemoteDesktop VNC: Remote Desktop for Apple products
- Ares RAT C&C: Ares is a remote access tool
- Bozok RAT C&C: Blackshades is the name of a malicious RAT (remote access trojan)
- Quasar RAT C&C: QRAT is a botnet command & control server.
- DarkComet Trojan: Crestron is a control system for building management
- Zero Access Trojan: A port is open and a service is listening but we cannot identify it