Detecting "Off Port" Services with Nessus

If you are attempting to perform network security monitoring in a large, unmanaged environment that has "poor" security, you are most likely dealing with botnets, phishing attempts, worms and Trojans. Many of these threats install some sort of FTP, SSH or Web server as a backdoor or drop point on a port other than the typical default port.

Discovering these on your network may help you find compromised servers, or even administrators who are trying to bypass firewall rules. This blog entry discusses how to find these "off port" services with the Passive Vulnerability Scanner (PVS), Nessus scanner and through log analysis.