Network Listeners (sec-network)

Monitors open network ports and reports listeners that are not on the whitelist. Detects unexpected services waiting for incoming connections.

Configuration

ParameterTypeDefaultDescription
enabledbooltrueEnable/disable module
allowed_listenerslist["22/tcp"]Allowed listeners in port/proto format
unexpected_listener_severityint1Severity for unexpected listeners (1=warning, 2=error)
ignore_loopbackbooltrueIgnore loopback addresses (127.0.0.1)
ignore_dockerbooltrueIgnore Docker networks

YAML Example

sec_network:
  enabled: true
  allowed_listeners:
    - "22/tcp"
    - "443/tcp"
    - "80/tcp"
  unexpected_listener_severity: 2
  ignore_loopback: true
  ignore_docker: true

Diagnostic Codes

CodeSeverityMeaningRecommendation
50021–2Unexpected network listener foundIdentify the service, stop it or add to whitelist

Platform Support

  • Linux: Uses ss to detect open ports.
  • Windows: Uses netstat or PowerShell cmdlets.