AUDIT_PROCESS_ON_PORT

This check queries the process running on a given port. The check relies on ouput of “netstat -ano” and “tasklist /svc” to determine which process is running on which TCP/UDP port.

Usage

The allowed types are:

• value_type: POLICY_TEXT
• value_data: Arbitrary string, e.g., "foo.exe"
• port_type: TCP or UDP
• port_no: port number, e.g., 80, 445
• port_option: CAN_BE_CLOSED

Considerations:

• If port_option is set to CAN_BE_CLOSED, then the check returns a PASS result if the port is not open on the remote system, otherwise it generates an error.
• Windows 2000 and earlier do not support “netstat –ano”, so this check only works against Windows XP and above.

Examples

The following example checks whether the process running on tcp port 5900 is either “vss.exe” or “vssrvc.exe”.

The following example is similar to the first example, except that this example demonstrates use of check_type.