services on non standar ports

[jalfrey]

I want to take a service name "HTTP" then do a dynamic lookup and pull a list of "standard ports". If the application is not running on standard ports I want to report on that. For most apps there is a single port number. The lookup would be easy. For things like HTTP there are two standard ports of 80 and 8080. How can I do a lookup and get that list or even better a range of ports. 1,5,60-67 kind of thing?

[gkanapathy]

Splunk lookups can return multiple results that much, so all you have to do is include multiple matching entries in your lookup. By default, non-temporal lookups (name->port number would be non-temporal) will return up to 100 values, which will come back as a multi-valued field. You could do something like:

name=* | lookup stdports name OUTPUT portnum | where isnull(portnum)

to return any where the name doesn't give you back any port number.

ranges unforunately would have to just be enumerated, though you can use wildcards in lookup tables.

[jalfrey]

so my lookup table if I use your variable names would be:
stdports, name
http, 80
http, 8080
ssh, 22

and for http I would get: http=80, http=8080
?

[jalfrey]

I am writing an application for Sonicwall Firewalls. The device does DPI to determine the application. The logs already identify both the application and ports used. I can already search for all logs that have the application "http". The problem is I don't have a method to lookup the "default" port number. If there were only a single port number allowed then it would be a 1:1 and a simple lookup table would be fine. My problem is I could have one or more valid ports.

[bmacias84]

Thats a tough one as HTTP(S), SNMP, DNS, CIFS, etc are all layer 7 which is the highest layer. To get that information would require a sniffer (Wire Shark or ExtraHop). If you want to audit your application you could parse the config files for the ports or retreive it form an API. Netstat or netcat will only give you info up to Layer 4 info.