topic Network Tool Kit Bulk Port Check in All Apps and Add-ons

Network Tool Kit Bulk Port Check

ansif — Wed, 30 Sep 2020 03:42:14 GMT

Hi,

We can do bulk ping using this app

Ping:

... | lookup ping host as host_to_lookup | table _raw host sent received packet_loss min_ping max_ping avg_ping jitter return_code raw_output

Can we do Port scan?

Like all host with same port number?

Re: Network Tool Kit Bulk Port Check

LukeMurphey — Wed, 30 Sep 2020 03:46:31 GMT

It doesn't support that yet. This was an oversight on my part because I added the port scanning functionality after I had created the previous lookup commands. I opened a ticket to add the ability to do bulk port scans: https://lukemurphey.net/issues/2589

Update:
I added the ability to do this in version 1.5: https://splunkbase.splunk.com/app/3491/

See https://lukemurphey.net/projects/network-tools/wiki/Using_Lookups for how to use the lookup. You just need to make sure that the host field (e.g. "10.0.0.1") and the ports field (e.g. "80-1024,8000") are defined. I was testing it like this:

(dest=10.0.0.6 OR dest=10.0.1.11) | stats count by dest | eval ports="80,443,8000" | lookup portscan host as dest ports | table ports dest open_ports closed_ports

Re: Network Tool Kit Bulk Port Check

skyelowryvancit — Wed, 30 Sep 2020 03:46:34 GMT

Also bulk whois from ...|lookup whois host as host_to_lookup

Currently the response is an empty table with no content, The whois is performed and the results end up in index=main (even though nettools is the index specified in Configuration).

Not sure if this is a similar oversight or a different issue.