Skip to content

Discovered Listening Ports

Purpose

Discovered Listening Ports lists every port a discovered device was seen listening on. It is the evidence that finds services nobody was talking to at the time, which a flow capture misses: a host listening on a database port that nothing queried produces no flow at all. The on-screen subtitle reads: "Raw open-port scan results per device, captured by network-scan integrations - the observed evidence behind inference's port matches."

Where to find it

Discover → Application Inference → Discovered Listening Ports. The page header is Discovered Listening Ports.

What you see

Columns

  • Device Name
  • Port
  • Protocol: values seen: TCP.
  • Banner
  • Source: where the port was captured; values seen: Network Scan. Ports derived by an inference run from flow data can show another source.
  • Last Seen

The data also has First Seen, hidden by default.

The grid shows no service names: those are on Port / App Mapping.

Actions

The grid uses the standard toolbar: Create New, Edit, Remove selected, Clear selection, Reload table data, Enable spreadsheet editing, Export CSV and Import CSV.

Each row has a View Details action (the eye icon).

Form

Create New opens the Create new entry form. Edit opens the Edit entry form for the selected row, with the same fields filled in. The fields, in order:

  • Device Name
  • Port
  • Protocol
  • Banner
  • Source: text.
  • Last Seen: a date.

The footer has Cancel and Save.

Filters

Each column has a filter row, and the grid has a Search: box and a page-size selector (10, 25, 50 or All entries per page).

The grid remembers its Search: text, column filters, sort order and page size between visits. If the grid shows fewer rows than you expect, clear the Search: box and the filter row.

How to

Review what a scan found

  1. Run the Network Scan integration. Listening ports come from network-scan integrations, and an inference run can also derive them from flow data (the NetFlow inference result reports how many).
  2. Go to Discover → Application Inference → Discovered Listening Ports. Each row is a device, port and protocol that was seen listening.
  3. To see the ports of one device, enter its name in the Device Name filter.
  4. Look up what runs on a port on Port / App Mapping.

Check whether a missing application's port was seen

  1. On the Discovered Listening Ports grid, enter the port in the Port filter.
  2. If no row is shown, the port was not seen listening on any device.