banshee/network-collection/network/tcp/ports

TCP ports of a host

Says, for each TCP port of a list, whether the host accepts a connection on it, and how long the connection took to open. Two watches are offered: a port closed, and a slow connection.

How it works

For each port of the list set on the probe, the poller opens a TCP connection to the address of the host (host:address), IPv4 or IPv6, and closes it at once, sending nothing: the service behind the port receives no request.

Variable	Says	Default
`tcp:ports`	the ports to open, separated by commas, set on the probe: `22, 443, 3389`	— (required)
`protocol:tcp:timeout`	how long the opening of a connection is awaited, in seconds, 1 to 60	5

A port is open when the connection opens; its connection time is returned, in milliseconds.
A port is closed when the host refuses the connection, when nothing answers within the timeout (a firewall that drops it), or when a router says the host cannot be reached. Only its state is returned, no.
Each port is an instance, named by its number: the selection of the probe can leave some out, and "Port closed" names the port.
A port written twice is opened once. A port outside 1 to 65535, or a list without a port, stops the collector as misconfigured, before any connection.

A name in host:address is resolved by the poller's system; a name that does not resolve stops the collector as unreachable.

Prerequisites

The ports reachable from the poller: a firewall that drops the poller's connections shows the port closed.
tcp:ports set on the probe.

Outputs

Name	Label	Unit	Per instance
`open`	Port open	—	yes, per port
`connect-time`	Connection time	ms	yes, per port, when it is open

Watches

Name	Title	Kind	Defaults	Checked by default
`closed`	Port closed	state to avoid, on `open`	critical on `no`	yes
`slow`	Slow connection	above a threshold, on `connect-time`	warning above 200 ms, critical above 1000 ms	no

Limits

An open port says that something listens, not that the service answers well: watch the service itself where a collector reads it (web/https/page, network/tls/certificate).
A closed port and a host down look the same here: watch the host with network/icmp/ping to tell them apart.
The ports are opened one after the other: a long list of filtered ports takes as many timeouts.