Monitoring Ports

This section describes how to create policies that monitor ports in SL1 using NMAP or the SL1 agent.

Use the following menu options to navigate the SL1 user interface:

To view a pop-out list of menu options, click the menu icon ().
To view a page containing all of the menu options, click the Advanced menu icon ().

What is a Port?

Ports are used to route packets on a server to the appropriate application. Ports are like an apartment number in an apartment building; the street address (IP address) gets the message to the right building, and the apartment number (port number) gets the message to the right person. For example, port 80 is the standard port number for HTTP traffic, and port 80 packets are processed by a Web server.

Ports can use the UDP protocol or the TCP protocol. UDP does not include a handshake, does not ensure packets are sent in a particular order, does not return error messages, and will not automatically try to resend or re-receive a packet; TCP will do all these things. Commonly used UDP ports include port 53 for DNS and port 161 for SNMP. Commonly used TCP ports include port 80 for HTTP, port 25 for SMTP, and port 20 for FTP.

Ports 0-1023 are used by common Internet applications such as HTTP, FTP, and SMTP. Ports 1024-49151 can be registered by vendors for proprietary applications.

Port Security

The Port Security page (Devices > Device Manager > bar-graph icon > TCP/UDP Ports tab) displays a list of all open ports on a device.

For SNMP and pingable devices, SL1 scans each device's TCP ports using NMAP.

For devices monitored using the SL1 agent, the agent reports open TCP and UDP ports. By default, the list of discovered ports is then automatically updated in SL1 every 5 minutes per agent.

The Port Security page displays open port information collected using NMAP and the SL1 agent, where applicable.

For SNMP and pingable devices, SL1 scans all the ports of each managed device every day. If any new ports are opened, SL1 updates the Port Security page and creates an event to notify users. You can explicitly ask that a device not be scanned nightly using NMAP, but if you do, SL1 will not notify you of newly opened ports on the device.

Port Availability

SL1 can monitor ports for availability. When a port monitor is created, SL1 monitors the port for availability every five minutes.

You can choose whether a policy is executed by SL1 using NMAP or locally on the device by the SL1 agent.

During polling, a port has two possible availability values:

100%. Port is up and running.
0%. Port is not accepting connections and data from the network.

The data gathered by the port monitor is used to create port-availability reports.

If a port is not available, SL1 creates an event with the message "port not responding to connection".

To monitor port availability, you must define a port monitoring policy. This is described in the following sections.

System Settings that Affect Port Availability Monitoring

Although you are not required to define system settings for port availability, you might find it useful to understand how these settings affect port monitoring.

The Behavior Settings page (System > Settings > Behavior) includes the following settings that affect policies for port availability:

Port Polling Type. Specifies how SL1 should poll ports for availability using NMAP. The choices are:

Half Open. Uses a faster TCP/IP connection method (a TCP SYN scan, nmap -sS) and does not appear on device's logs.
Full Connect. Uses the standard TCP/IP connection (TCP connect() scan, nmap -sT) to detect open ports.

Viewing the List of TCP/IP Port Monitoring Policies

You can view a list of TCP/IP port monitoring policies from the TCP/IP Port Monitoring page (Registry > Monitors > TCP-IP Ports).

The TCP/IP Port Monitoring page displays the following information for each TCP/IP port monitoring policy:

NOTE: Users of type "user" can view only IP ports that are aligned with the same organization(s) to which the user is aligned. This means that the device associated with the port(s) must be aligned with one of the organizations to which the user is aligned. Users of type "administrator" can view all IP ports.

TCP/IP Port Number. Port number of the port to be monitored.
Monitor IP Address. IP address associated with the port to be monitored. For devices with multiple IP addresses, the IP address for the port policy might be different than the IP address used by SL1 to communicate with the device.
Policy ID. Unique, numeric ID, assigned to the policy automatically by SL1.
State. Whether the policy is enabled or disabled.
Device Name. Name of the device associated with the policy.
IP Address. IP address of the device associated with the policy. This is the IP address SL1 uses to communicate with the device.
Device Category. Device category of the device associated with the policy.
Organization. Organization for the device associated with the policy.

From the list of policies, you can select the checkbox for one or more policies and choose one of the following bulk actions from the Select Action drop-down at the bottom right of the page:

Delete Monitors. Deletes the selected policies from SL1. The associated reports (from the Device Reports > Performance tab) are also deleted.
Enable Monitors. Enables the selected policies so that SL1 can collect the data for these policies.
Disable Monitors. Disables the selected policies. SL1 will not collect the data specified in these policies.

Filtering the List of TCP/IP Port Monitoring Policies

You can filter the list of discovered port monitoring policies on the TCP/IP Port Monitoring page by one or more parameters. Only policies that meet all the filter criteria will be displayed in the TCP/IP Port Monitoring page.

To filter by parameter, enter text into the desired filter-while-you-type field. The TCP/IP Port Monitoring page searches for policies that match the text, including partial matches. By default, the cursor is placed in the left-most filter-while-you-type field. You can use the <Tab> key or your mouse to move your cursor through the fields. The list is dynamically updated as you type. Text matches are not case-sensitive.

You can also use special characters to filter each parameter.

Filter by one or more of the following parameters:

Port Number. You can enter text to match, including special characters, and the TCP/IP Port Monitoring page will display only policies that monitor ports with matching port number.
Monitor IP Address. You can enter text to match, including special characters, and the TCP/IP Port Monitoring page will display only policies that monitor a port with a matching IP address.
Policy ID. You can enter text to match, including special characters, and the TCP/IP Port Monitoring page will display only policies that have a matching policy ID.
State. You can enter text to match, including special characters, and the TCP/IP Port Monitoring page will display only policies that have a matching state (enabled or disabled).
Device Name. You can enter text to match, including special characters, and the TCP/IP Port Monitoring page will display only policies aligned with a device with a matching device name.
IP Address. You can enter text to match, including special characters, and the TCP/IP Port Monitoring page will display only policies aligned with a device with a matching IP address.
Device Category. You can enter text to match, including special characters, and the TCP/IP Port Monitoring page will display only policies aligned with a device with a matching device category.
Organization. You can enter text to match, including special characters, and the TCP/IP Port Monitoring page will display only policies that have a matching organization.

Defining a Port Monitoring Policy

SL1 enables you to create policies that monitor ports. When a port monitoring policy is created, SL1 monitors the port for availability every 5 minutes. You can choose whether a policy monitors port availability.

NOTE: Non-administrator users can view only IP ports that are aligned with the same organization(s) to which the user is aligned. This means that the device associated with the port(s) must be aligned with one of the organizations to which the user is aligned. Administrator users can view all IP ports.

To define a port monitoring policy:

Go to the Devices page and click the Device Name of the device for which you want to define a port monitoring policy. The Device Investigator displays.

Click the Monitors tab.

Click Create, and then select Create TCP/IP Port Policy. The TCP/IP Port Policy modal appears:

In the TCP/IP Port Policy modal, supply a value in each of the following fields:

Select IP Device. Select a device from this drop-down list to align with this policy. By default, the current device is selected in this field.

Device IP Address. IP address through which SL1 communicates with the device.
Port/Service. Port number and the corresponding service running on the port.
Monitor Method. Select whether the policy will be executed using NMAP or using the SL1 agent. This option is available only if you selected a device on which the agent is installed.

Monitor State. Specifies whether SL1 should start collecting data specified in this policy from the device. Choices are:

Enabled. SL1 will collect the data specified in this policy, from the device, at the frequency specified in the Process Manager page (System > Settings > Processes) for the Data Collection: TCP Port Monitor process.
Disabled. SL1 will not collect the data specified in this policy, from the device, until the State field is set to Enabled.

Critical Poll. Frequency with which SL1 should "ping" the device. If the device does not respond, SL1 creates an event. The choices are:

Disabled. SL1 will not ping the device.
Enabled. SL1 will ping the device every 15, 30, 60, or 120 seconds, as specified.

NOTE: SL1 uses Critical Poll data to create events when mission-critical ports are not available. SL1 does not use this critical poll data to create port-availability reports. SL1 will continue to collect port availability only every five minutes.

Click Save.

Example Policy for TCP/IP Port Availability

This policy monitors a TCP/IP port on the device "cisco_10.2.1.29", at IP address 10.1.0.205.
The policy will monitor port 22 for availability.

Defining a Port Monitoring Policy in the Classic SL1 User Interface

You can define a port monitoring policy in the TCP/IP Port Policy modal. You can access theTCP/IP Port Policy page either from the Device Manager page (Devices > Device Manager) or from the TCP/IP Port Monitoring page (Registry > Monitors > TCP-IP Ports).

To access the TCP/IP Port Policy modal from the Device Manager page:

Go to the Device Manager page (Devices > Device Manager)
In the Device Manager page, find the device that you want to associate with the monitoring policy. Click the wrench icon () for the device.
In the Device Administration panel for the device, click the Monitors tab.
From the Create menu in the upper right, select Create TCP/IP Port Policy.
The TCP/IP Port Policy modal appears.

To access the TCP/IP Port Policy modal from the TCP/IP Port Monitoring page:

Go to the TCP/IP Port Monitoring page (Registry > Monitors > TCP-IP Ports).
Click the Create button.
The TCP/IP Port Policy modal appears.

For information about completing the fields in the TCP/IP Port Policy modal, see the section on Defining a Port Monitoring Policy.

Editing a Port Monitoring Policy

To edit a port monitoring policy:

Go to the Devices page and click the name of the device for which you want to edit a monitoring policy. The Device Investigator displays.
Click the Monitors tab.
Find the policy you want to edit and click its wrench icon (). The TCP/IP Port Policy modal appears.
In the TCP/IP Port Policy modal, you can change the values in one or more of the fields described in the section on Defining a Port Monitoring Policy.
Click Save.

Editing a Port Monitoring Policy in the Classic SL1 User Interface

You can edit a port monitoring policy on the TCP/IP Port Policy modal. You can access the TCP/IP Port Policy modal either from the Device Manager page (Devices > Device Manager) or from the TCP/IP Port Monitoring page (Registry > Monitors > TCP-IP Ports).

To access the TCP/IP Port Policy modal from the Device Manager page:

Go to the Device Manager page (Devices > Device Manager)
In the Device Manager page, find the device that you want to associate with the monitoring policy. Click the wrench icon () for the device.
In the Device Administration panel, click the Monitors tab.
In the Monitoring Policies page, find the port policy you want to edit and click its wrench icon ().
The TCP/IP Port Policy modal appears.
In the TCP/IP Port Policy modal, you can change the values in one or more of the fields described in the section on Defining a Port Monitoring Policy.
Click Save.

To access the TCP/IP Port Policy modal from the TCP/IP Port Monitoring page:

Go to the TCP/IP Port Monitoring page (Registry > Monitors > TCP-IP Ports).
Find the device and port for which you want to edit the monitoring policy. Click the wrench icon () for the port.
The TCP/IP Port Policy modal appears.
In the TCP/IP Port Policy modal, you can change the values in one or more of the fields described in the section on Defining a Port Monitoring Policy.
Click Save.

Executing a Port Monitoring Policy

After creating or editing a TCP-IP port monitoring policy, you can manually execute the policy and view detailed logs of each step during the execution.

NOTE: After you define a TCP-IP port monitoring policy and enable the policy, SL1 or the SL1 agent will automatically execute the policy every five minutes. However, you can use the steps in this section to execute the policy immediately and see debug information about the execution of the policy.

To manually execute a port monitoring policy:

Go to the Devices page and click the name of the device for which you want to execute the monitoring policy. The Device Investigator displays.
Click the Monitors tab.
Find the policy you want to run manually and click its lightning bolt icon ().
The Session Logs modal opens while the policy is executing. The Session Logs page provides detailed descriptions of each step during the execution. This is helpful for diagnosing possible problems with a policy.

Executing a Port Monitoring Policy in the Classic SL1 User Interface

After creating or editing a TCP-IP port monitoring policy, you can manually execute the policy and view detailed logs of each step during the execution. To do so:

In the TCP/IP Port Monitoring page (Registry > Monitors > TCP-IP Ports), find the policy you want to run manually.
Click the lightning bolt icon () to manually execute the policy.
While the policy is executing, SL1 spawns a modal called Session Logs. The Session Logs page provides detailed descriptions of each step during the execution. This is helpful for diagnosing possible problems with a policy.

Deleting a Port Monitoring Policy

You can delete a port monitoring policy from the Monitors tab of the Device Investigator. When you delete a monitoring policy, SL1 no longer uses the policy to collect data from the aligned device. Deleting a monitoring policy will also remove all data that was previously collected by the policy.

To delete a port monitoring policy:

Go to the Devices page and click the name of the device for which you want to delete the monitoring policy. The Device Investigator displays.
Click the Monitors tab.
Find the policy you want to delete and click its bomb icon (). A confirmation prompt appears.
Click OK.

Deleting a Port Monitoring Policy in the Classic SL1 User Interface

You can delete one or more port monitoring policies from the TCP/IP Port Monitoring page. When you delete a monitoring policy, SL1 no longer uses the policy to collect data from the aligned device. Deleting a monitoring policy will also remove all data that was previously collected by the policy.

To delete a port monitoring policy in the classic SL1 user interface:

Go to the TCP/IP Port Monitoring page (Registry > Monitors > TCP-IP Ports).

In the TCP/IP Port Monitoring page, select the checkbox(es) for each port monitoring policy you want to delete. Click the checkmark icon () to select all of the system process policies.

In the Select Action menu in the bottom right of the page, select Delete Monitors.

Click Go to delete the port monitoring policy.
The policy is deleted from SL1. The associated reports (from the Device Reports > Performance tab) are also deleted.

Viewing a List of All TCP/IP Ports

The TCP/IP Port Editor page (System > Customize > TCP-IP Ports) allows you to view the properties of TCP ports. SL1 uses this list of ports and their definitions when scanning devices to discover open ports.

For each port defined in the TCP/IP Port Editor page, SL1 can search each device to see if the port exists and if it is operational. For each device, SL1 displays the list of discovered, open ports in the Port Security page.

NOTE: TCP ports are logical connections that applications use to communicate between computers. TCP ports are not to be confused with interfaces, which are hardware based.

SL1 includes definitions of all IANA "well-known ports" (0 - 1023) as well as many IANA registered ports (1024 - 49151) and application-specific or user-defined dynamic ports (49152 and greater). If your network includes a port that is not already defined in the TCP/IP Port Editor page, you can define the port manually.

The TCP/IP Port Editor page contains a pane at the bottom of the page called the Registry of Manageable Ports. This pane displays all the ports defined in SL1. These are the ports that SL1 can scan for and manage. For each port, the TCP/IP Port Editor page displays the following:

Name. Name or alias of the port. For well-known ports, use the IANA port name.
Port Number. Port number for the TCP port.
Protocol. Currently SL1 scans only TCP ports.
Description. A brief description of the port, including the service/application that uses the port.
Poll State. Specifies whether SL1 should poll this port for availability data. This data is used by SL1 in availability reports. Choices are Enabled or Disabled.
Illicit Port Alarm. Specifies whether SL1 will generate an event if the port is discovered. This option should be enabled only for unauthorized ports. Choices are On or Off.
GUI Feature. For devices that include this port, specifies the tools that should appear in the Device Toolbox page to perform diagnostics and administration on the port.

Defining a New TCP/IP Port

If your network includes one or more ports that aren't defined in the TCP/IP Port Editor page, you can define these ports manually. To manually define a port:

Go to the TCP/IP Port Editor page (System > Customize > TCP-IP Ports) .
In the TCP/IP Port Editor page, go to the registry pane at the bottom of the page. Find the port definition you want to edit. Select its wrench icon ().
In the editor pane (at the top of the page), supply a value in each of the following fields:

Description. A brief description of the port, including the service/application that uses the port. Can be any combination of alpha-numeric characters, up to 128-characters in length.
Port Name. Name or alias of the port. For well-known ports, use the IANA port name. Can be any combination of alpha-numeric characters, up to 48-characters in length.
Port Number. Port number for the TCP port. Can be any combination of numbers, up to 5-digits in length.
Poll State. Specifies whether SL1 should poll this port for availability data. This data is used by SL1 in availability reports. Choices are:

Enabled. Poll this port to gather availability data.
Disabled. Don't poll this port to gather availability data.

Illicit Port Alarm. Specifies whether SL1 should generate an event if the port is discovered. This option should be enabled only for unauthorized ports. Choices are:

Enabled. Generate an event if SL1 discovers this port on a device.
Disabled. Do not generate an event if SL1 discovers this port on a device.

Toolbox Feature. For devices that include this port, specifies the tools that should appear in the Device Toolbox page. Choices are:

None
Web. Opens a new browser window and attempts to make an HTTP connection to the current device.
FTP. Opens a new browser window and attempts to make an FTP connection to the current device.
Secure Web. Opens a new browser window and attempts to make an https connection to the current device.
Telnet. Opens a browser session or terminal session using the IP address of the current device and prompts you for the telnet user name and password.
Terminal. Opens the Terminal Services Client Web Connection modal page, where you can enter the login information for the terminal services session.
SSH. Opens a browser session for a secure SSH connection to the device.

Click Save.

Editing the Properties of a Port

You can edit one or more parameters of a port definition. When you edit a port's properties, you change how SL1 manages the port on each device where the port is discovered.

To edit a port definition:

Go to the TCP/IP Port Editor page (System > Customize > TCP-IP Ports).
Click the Refresh button to clear any values from the editor pane.
Locate the TCP/IP port definition that you want to edit and click its wrench icon (). The editor pane (at the top of the page) is populated with values from the port definition.

You can use the search fields immediately below the editor pane to help you locate the port definition that you want to edit.

Edit the values in one or more of the fields in the editor pane.
Click Save to save any changes to the port definition.

Deleting a Port Definition

From the TCP/IP Port Editor page, you can delete the definitions for one or more TCP ports.

CAUTION: If you delete the definition of a TCP port, SL1 will not be able discover that port on any devices in the network. To discover open ports and to monitor ports for availability, SL1 must include a definition of the port in the TCP/IP Port Editor page.

To delete one or more port definitions from SL1:

Go to the TCP/IP Port Editor page (System > Customize > TCP-IP Ports).
In the TCP/IP Port Editor page, go to the registry pane at the bottom of the page. Locate the port definition you want to delete and select its checkbox ().

You can use the search fields immediately above the registry pane to help you locate the port definition that you want to delete.

Repeat step 2 to select any additional port definitions you want to delete.
Click Delete. All selected port definitions are deleted.

Viewing a List of All Open Ports on All Devices

The Network IP Ports page displays a list of all open ports on all devices discovered by SL1 using NMAP and the SL1 agent.

To view the Network IP Ports page:

Go to the Network IP Ports page (Registry > Networks > IP Ports).

The Network IP Ports page displays a list of all discovered ports. For each port, the Network IP Ports page displays the following:

To sort the list of ports, click on a column heading. The list will be sorted by the column value, in ascending order. To sort the list by descending order, click the column heading again.

Device Name. Name of the device where the port resides. For devices running SNMP or with DNS entries, the name is discovered automatically. For devices without SNMP or DNS entries, the device's IP address will appear in this field.
Device Classification. The manufacturer (device class) and type of device (sub-class). The Device-Class/Sub-Class is automatically assigned during auto-discovery, at the same time as the Category.
Organization. The Organization associated with the device and port.
IP Address. IP address associated with the open port.
Service Name. The service accessed through the port.
Port. The port number.
Protocol. Either TCP or UDP.
Monitored. Specifies whether SL1 is monitoring this port for availability.
State. This column has a value only if a port-monitoring policy has been defined for the port. This field can have one of two values:

Enabled. The port-monitoring policy has been activated. SL1 monitors the port and collects availability data about the port.
Disabled. The port-monitoring policy has not been activated. SL1 will not monitor the port and does not collect availability data about the port.

Filtering the List of Network IP Ports

You can filter the list of discovered IP ports on the Network IP Ports page by one or more parameters. Only IP ports that meet all the filter criteria will be displayed in the Network IP Ports page.

To filter by parameter, enter text into the desired filter-while-you-type field. The Network IP Ports page searches for IP ports that match the text, including partial matches. By default, the cursor is placed in the left-most filter-while-you-type field. You can use the <Tab> key or your mouse to move your cursor through the fields. The list is dynamically updated as you type. Text matches are not case-sensitive.

You can also use special characters to filter each parameter.

Filter by one or more of the following parameters:

Device Name. You can enter text to match, including special characters (comma, ampersand, and exclamation mark), and the Network IP Ports page will display only IP ports that are associated with a matching device name.
Device Classification. You can enter text to match, including special characters (comma, ampersand, and exclamation mark), and the Network IP Ports page will display only IP ports that are associated with a matching device class.
Organization. You can enter text to match, including special characters (comma, ampersand, and exclamation mark), and the Network IP Ports page will display only IP ports that are associated with a matching organization.
IP Address. You can enter text to match, including special characters (comma, ampersand, and exclamation mark), and the Network IP Ports page will display only IP ports that are associated with a matching IP address.
Service Name. You can enter text to match, including special characters (comma, ampersand, and exclamation mark), and the Network IP Ports page will display only IP ports that have a matching service name.
Port. You can enter text to match, including special characters (comma, ampersand, and exclamation mark), and the Network IP Ports page will display only IP ports that have a matching port number.
Protocol. You can enter text to match, including special characters (comma, ampersand, and exclamation mark), and the Network IP Ports page will display only IP ports that have a matching protocol.
Monitored. You can enter text to match, including special characters (comma, ampersand, and exclamation mark), and the Network IP Ports page will display only IP ports that have a matching value for Monitored. Choices are Yes and No.
State. You can enter text to match, including special characters (comma, ampersand, and exclamation mark), and the Network IP Ports page will display only IP ports that have a matching value for policy State. Choices are Enabled and Disabled.

Viewing a List of All Open Ports on a Single Device

On the Ports tab of the Device Investigator, you can view a list of all open ports on a device:

Every night, SL1 scans all the ports of each managed device. If any new ports are opened, SL1 adds the port to the list on the Ports tab.

For each open port on the device, the Port Security page displays the following information:

Interface IP. IP address through which SL1 communicates with the device.
Port Number. The ID number of the port.
Service. The service accessed through the port.
Protocol. Either TCP or UDP.
Certificate Issuer. If the service on this port uses a certificate, this column contains the name of the certificate authority.

NOTE: Certificates are used by secure services like HTTPS, SSL, SSH, and SFTP to verify communication and encrypt message. The certificate issuer (also known as the certificate authority or CA) is an organization that issues digital certificates (digital IDs). These digital IDs (called keys) authenticate the identity of people and organizations over a public system such as the Internet. These keys also allow senders and receivers to encrypt messages and un-encrypt replies.

Cert. Expiration. The expiration date of the certificate.

Viewing a List of All Open Ports on a Single Device in the Classic SL1 User Interface

The Port Security page displays a list of all open ports on a single device.

To view the Port Security page for a device:

There are two ways to view the Port Security page:

Go to the Device Manager page (Devices > Device Manager). Find the device where you want to view the Port Security page. Select the bar graph icon () for that device.

Go to the Network IP Ports page (Registry > Networks > IP Ports). Find the device for which you want to view the Port Security page. Select the flashlight icon () for that device.

In the Device Reports panel, select the TCP/UDP Ports tab. The Port Security page appears.

For each open port on the device, the Port Security page displays the following information:

Interface IP. IP address through which SL1 communicates with the device.
Port Number. The ID number of the port.
Service. The service accessed through the port.
Protocol. Either TCP or UDP.
Certificate Issuer. If the service on this port uses a certificate, this column contains the name of the certificate authority.

Cert. Expiration. The expiration date of the certificate.

Viewing Port Availability Reports for a Single Device

See the section on Viewing Performance Graphs for information and examples of reports for port availability.