How can I find available but unoccupied ports on a Linux box?

Question

Specifically RHEL 6.5

It's a Dev box and we have certain port ranges we are permitted for development use. ...unfortunately, getting a tech's attention to find out what ports are available is like pulling teeth. Would prefer a script or alias that does this so that we don't have to ask all the time. Clues? Is this an iptables command or is it a netstat command or some weird combo? nmap is not available on this machine.

Please don't say this is a Server Fault question. They say it's a programming question. :-|

Answer 1

Definitely a SF question but here we go. From the dev box itself (command line) you should be able to see what ports are in use with the netstat tool.

To see the list of listening ports both UDP and TCP, complete with the program names:

# preferably as root
netstat --listening --program --numeric-ports --protocol=ip -6 -4

From another machine, you can use nmap or a similar tool to see what ports are open/listening by scanning the IP address assigned to the dev box. Before trying this, maybe you should ask for permission. Also, you should consider that the box in question might have firewall rules in place that can thwart your scanning attempts.

To see what firewall rules are in place in the dev box try:

# as root
iptables -nvxL -t filter

# maybe there are NAT rules, redirects to other addresses, etc.
iptables -nvxL -t nat

To see what these iptables options do, try man iptables.

As an example, assuming 172.16.0.1 is the IP address assigned to the dev box, to run nmap in the simplest way possible:

# preferably as root
nmap -v 172.16.0.1

In a few minutes you should see a list of ports/services listening in that relevant box. Try man nmap and read the documentation for more details.

If you really think this is a programming issue, you can use the netcat tool and program a simple script to do something roughly equivalent to what nmap does.

#!/bin/bash
# 
# DISCLAIMER: NOT TESTED -- just an example
# NOTE: This will take many DAYS to complete

HOST=172.16.0.1

for port in `seq 1 65535` 
do 
   echo "Trying ${port}..." 
   netcat -vvv ${HOST} $port -w 1 -z  
done

For every open TCP port you should see a line similar to this:

Connection to 172.16.0.1 23 port [tcp/telnet] succeeded!