Ports for ELK Set up - elk

I checked the document, so far I found those ports are needed to open ,
My questions Did I miss anything , are there more ports needed?
Logstash Ports 5044, 9600 and 9700
Kibana Port 5601
ElastichSearch Ports 9200, 9300
Thanks and Rgds

Related

Apache2 Webserver needs port

I experienced some issues with Apache2. I’ve bought a domain at strato e.g. webserver.com. Now I am running Apache2 on a raspberry pi. The port forwarding is already configured. I only can forward a specific number of ports in a specific range, e.g. 12000 to 13000. So I forwarded the Webserver on port 12000. The A-Record has my external ip-adress set. If I want to access my page I need to type in: Webserver.com:12000.
How can I resolve this issue?

Gatling j.n.ConnectException: Address already in use

When running simulations with Gatling I get the following exceptions:
j.n.ConnectException: Address already in use: no further information
Does this occur when the server tested against fails to respond or timeout?
I want to make sure this is a exception thrown by the server and not by the client.
I also encountered this problem running Gatling (with a lot of requests, > 100 RPS) on Windows. It seems Windows is running out of ephemeral ports to use. See this discussion in the user group forum. So this is not a problem with your system under test, but with the machine running Gatling.
On Windows, you can see and change your ephemeral port range using the netsh command. You can use following commands to
see your currently configured IPv4 port range for TCP:
netsh int ipv4 show dynamicport tcp
change the port range:
netsh int ipv4 set dynamic tcp start=number num=range
E.g., I increased my ephemeral IPv4 TCP port range like so to resolve the problem:
netsh int ipv4 set dynamic tcp start=1025 num=57975

How to know if a Port is available for my application I am going to Install

I have a very doubt , plz correct me ..
I have a windows server and I need to install a application/product on it . This application/product uses certain ports, and I need to enter those ports while configuring this application.
So I need to know if say 19800 port is available or not.
what I did to know if 19800 is available or not:
1)netstat -na -- this gave me list of ports with status listening/established/Time_wait ..
I didnt find 19800 port in outout of netstat -na..
So does that mean 19800 port is not there and I need to ask window administrator team to open this port?
2)I think netstat -na gives the port which are in use or accepting some connections ..
It actually doesn't give you list of all the ports that the server have , because server generally have more than 60000 ports , and the output from netstat -na gives somewhere 100 entries..
3)what I dream is to know what all ports are there on this server , and if I find my port name I can assign that port to my application.
Thanks
rick
If you want to check, the availability of a PORT, you may use different approaches the simplest one in this case could be depending on your programming language you may do the following:
port_available = TRUE
try:
open(HOST,PORT)
exception PORT_NOT_AVAILABLE:
port_available = FALSE
Using the output from netstat and parsing it using text editor could be a nightmare.

Is it possible to capture localhost packets (127.0.0.1 as destination) in NDIS layer?

I am developing an NDIS 6 filter driver of Win7 and Win8 for WinPcap and Nmap. As you know, Nmap is a network scanner. A requirement of Nmap is to capture localhost packets like "ping 127.0.0.1", so that Nmap can test the local machine itself, too. However, it seems that the localhost packets will just return in the TCP/IP stack and never comes to the NDIS layer. Is there any way to resolve this issue? Like adding a loopback adapter or what? Thanks.
You'll need a WFP callout to capture layer-3 loopback packets. TCPIP has a fast-path for loopback that never reaches layer-2 in NDIS.
You can capture localhost (127.0.0.1) traffic in Windows by using raw sockets. There is a great tool called RawCap that sniffs localhost and saves the captured packets in the PCAP format.
http://www.netresec.com/?page=RawCap

Check what serial port i'm using in linux

I have a plugged usb-serial device plugged to my windows and serial mapped it using virtualbox e.g COM1 -> /dev/ttyS0..
Now how will i know which serial port my device is using.. I know right now im using /dev/ttyS0. but what if i don't know?.. Linux Debian is creating this permanent serial port devices on boot time /dev/ttyS0-S3.
How can i make a test that /dev/ttyS0 is the real port im using in c.
Here's my way of testing if it's the right port or not.
devfd=open("/dev/ttyS0",O_WRONLY | O_NOCTTY | O_NDELAY);
if(s_fd<0) exit(1);
printf("open\n"); //It will always return true printing open because this device is created on boot time and is always available. so i made another check and that is to write to the port(Assuming i have set the permission to have full access to the serial port). if i can write to the port then it means it is really the port im using.
test=write(devfd,"ATZ",4);
if(test<0) printf("Can't write to port: Maybe not the serial port ur using\n");
printf("Device is avaialable\n"); // returns true because we can write to the port
Can you show me other samples in c of how can Check serial port if there's a device plugged to that serial port?
Or a test in c to the following serial port /dev/ttyS0 - /dev/ttyS3 if the following have devices plugged on them.
Thanks.
The Standard Serial ports are mapped as /ttyS0,/ttyS1,... as you correctly stated.
Generic USB Serial Ports as well as most G3 modems are accessible as /dev/ttyUSB0 through /dev/ttyUSB255
The better way to distinguish if a serial port 'connected' with a modem is to send ATIx commands to the serial port. These are Identity commands that you may use to detect the model name of the device and many other details.
First you try to send ATIx command not changing the baud rate. If you do not receive any valid response (ASCII multi-line text followed by OK<CR><LF> ERROR...<CR><LF> then you may alter the baud rate and retry. It is better to first set the maximum supported by port speed and then decrease it until you find a modem or you end up with 110 baud or other reasonable limit.
There is a way to detect if most likely there is nothing connected to the serial port. The idea behind is to detect the frame error that persists during some reasonable time (tens times to receive a byte at selected baud rate), say 2-3sec. To see how enable/disable frame errors detection look at man termios. Howeever, I am not absolutely sure that in the setup you described this will be possible (from within VM), so you have to try.
Also look at this post How to connect to a terminal to Serial-USB device on Ubuntu 10.10?
Be aware, that I found by experience that writing to a serial port to test it can have dire consequences; as my script hung (but only when running on ESXi hypervisor) when trying to test write to a disconnected device
In case it helps, here is a safer way to check
cat /proc/tty/driver/serial | \
grep -v unknown | \
sed 's/^/ttyS/g'
and then check output for ttyS0 for example

Resources